Pornhub Is Now Blocked In Almost All of the U.S. South

[Eric]

Here come the Republicans to protect your personal liberty. Yet another law to protect something that doesn't exist.

Pornhub Is Now Blocked In Almost All of the U.S. South

As of today, three more states join the list of 17 that can't access Pornhub because of age verification laws.

www.404media.co

Almost two years ago, Louisiana passed a law that started a wave that’s since spread across the entire U.S. south, and has changed the way people there can access adult content. As of today, Florida, Tennessee, and South Carolina join the list of 17 states that can’t access some of the most popular porn sites on the internet, because of regressive laws that claim to protect children but restrict adults’ use of the internet, instead.

 

[Hrafn]

Reading between the lines, they still have access to the less popular sites...

 

[Chew Toy McCoy]

Not saying I agree with these laws, but it is kind of insane how easy it is to access free porn with at best a speed bump relying on somebody not lying about their age.

 

[Eric]

Not saying I agree with these laws, but it is kind of insane how easy it is to access free porn with at best a speed bump relying on somebody not lying about their age.

The industry is so competitive that it's easy to see why it's over saturated.

As for the age restrictions I think it becomes more a right of privacy than anything, I mean look at how bad it is with cookies and marketing just to surf the web as it is. Now imagine they have access to your real life personal ID, etc. no way I would ever input that for a porn site and I'm guessing most will refuse.

 

[Yoused]

I wonder if nambla org is blocked in those states.

 

[Herdfan]

So a technical question.

When I was in WV, I had Comcast as my internet provider. But its headend was in OH (a result of how Adelphia was split up).

So my IP would say I was in Portsmouth OH. If WV banned PH, how would that work.

Same with cellular data. I might have physically been in WV, but my IP resolved to MD.

Also, say I had Starlink on my motorhome, will it know where I am and ban sites at that location?

 

[Eric]

So a technical question.

When I was in WV, I had Comcast as my internet provider. But its headend was in OH (a result of how Adelphia was split up).

So my IP would say I was in Portsmouth OH. If WV banned PH, how would that work.

Same with cellular data. I might have physically been in WV, but my IP resolved to MD.

Also, say I had Starlink on my motorhome, will it know where I am and ban sites at that location?

Other people with more expertise than myself may chime in here but I see that the same as a VPN, in that if it resolves to MD then it's viewed as being in MD. That said if you're hitting a local datacenter enroute without being behind a VPN it may still get blocked.

 

[Nycturne]

Other people with more expertise than myself may chime in here but I see that the same as a VPN, in that if it resolves to MD then it's viewed as being in MD. That said if you're hitting a local datacenter enroute without being behind a VPN it may still get blocked.

Pretty much.

The issue is that geolocation by IP isn't perfect. It's a sort of best-effort approach based on databases that do a lookup of the IP and return a location. Sometimes, an IP address may get assigned a completely different country, let alone state. Especially since networks have to get more and more use out of their IPv4 ranges and will mix traffic from different regions in the same subnet, as we've effectively exhausted the unallocated ranges.

So my IP would say I was in Portsmouth OH. If WV banned PH, how would that work.

A thing to consider here is that the states aren't banning PH, but they are requiring PH to adhere to a set of requirements to continue operating within the state. So instead of complying with the requirements which effectively require site operators to maintain a bunch of PII on every single user, they "pull out" of the state by blocking access to users from the state, under this best-effort approach. It's not perfect, but the goal here IMO is more to set the precedent and ensure a digital-only business can choose what regions it operates in the same way a physical business, or one that ships physical goods can.

EDIT: And streaming services already use this sort of IP-based geolocation to keep content owners happy when it comes to regional content deals. So at the very least, PH isn't trying to forge a new trail here, but trying to build on top of the same mechanisms Netflix/Hulu/etc use.

 

[Eric]

Pornhub pulls out of Florida, VPN demand 'surges 1150%'

State masks up finally – its IP addresses, that is

www.theregister.com

 

[casperes1996]

Thing is, age-gating some content in the digital world does make sense. But there's a lot of problems with the way we can achieve that at present, privacy being one of the major ones. What methods do we use to validate a user's age without needing too much information from them other than age, yet being able to trust the answer we get? Ignoring pornography there's a wealth of other use cases; Gambling websites (although by nature of requiring a credit card to begin with there's some inherent protection there), and similar content that in the physical realm we age-gate. Perhaps there's a reasonable need for a standardised approach to age restrictions and parental control systems across all computing vendors with regulatory backing.

Imagine a system where a central authority, or perhaps a series of decentralised authorities, vouch for your age. Places like government portals, banks, and other entities that already have a legitimate reason to tie your identity to your age, would create and hold public keys corresponding to your identity. Now you try to access an age restricted site like PH. You enter in an identifier matching a public key, but probably in some human friendly format like a username, and the website encrypts a packet containing: (randomChallenge, minAge, maxAge?, t, f , contentPub) with the public key. t and f are random values. Though it is encrypted for your public key, and the corresponding private key is known by the authority, the website you're accessing does not send this directly to the authority, but the package is sent to your device directly. You then open your "Age Verifier" app and pass the data packet on and validate your identity with a 2FA code in a standard scheme. The authority decrypts the packet. If your identity's age is within the min-max range, it XORs the randomChallenge with t. If it is not, it XORs it with f. It encrypts the result with contentPub, the public key belonging to the content you're trying to access and sends the result back to you so you can pass it on to the content. Assuming I haven't made any mistakes here, only the authority can do the t/f XOR challenge on decrypted content (depending on encryption scheme we can replace with multiply, add, exponentiate or whatever) and only the content holder can decrypt the result and the answer of course should not be malleable to flipping t and f. To prevent that we probably need the original packet to contain another value "o" representing the ordering of the other variables so t and f are not always the same bits in the encrypted package.
With this scheme, the content doesn't learn anything about you, not even your actual age, only whether you're within the allowed range or not. The authority doesn't learn what page you're trying to visit assuming the public key of the content holder is generated per-request, and the authority should be trusted. Two issues remain. The authorities get to know how frequently you try to access age-gated content which can also be seen as a privacy violation, and the content holder can possibly join up with other content providers to map your public key's activities to you. Here's how I propose to solve that.

1) As part of standardising this technology, all OS vendors put in daemons that continually make request up. All HTTP(S) requests come with an attempt following a valid but unused execution of the above protocol. As all requests are now effectively age-gated it no longer really means anything. Note that 2FA is not required here. Since the answers to the requests don't matter and the protocol can be made such that the authority sends its result package and 2FA request in one single message with the result only being accessible after 2FA'ing it, it cannot tell the difference between a 2FA unlocked request and a one shot ignored request.

2) After every request, a new public key is generated for your identity. The exact algorithm for it can be anything really as long as content providers cannot deterministically guess it, but it could incorporate the challenge from the prior request and your 2FA code as well as username




Just a quick off the top of my head idea for what it could look like. Then we just need regulation requiring certain types of content to use this standard. - Alternatively we could just use the already existing parental control features in modern operating systems, standardise those and require web content to ask the OS about parental control levels and just make parents setup those parental control systems

 

[rdrr]

Thing is, age-gating some content in the digital world does make sense. But there's a lot of problems with the way we can achieve that at present, privacy being one of the major ones. What methods do we use to validate a user's age without needing too much information from them other than age, yet being able to trust the answer we get? Ignoring pornography there's a wealth of other use cases; Gambling websites (although by nature of requiring a credit card to begin with there's some inherent protection there), and similar content that in the physical realm we age-gate. Perhaps there's a reasonable need for a standardised approach to age restrictions and parental control systems across all computing vendors with regulatory backing.

Imagine a system where a central authority, or perhaps a series of decentralised authorities, vouch for your age. Places like government portals, banks, and other entities that already have a legitimate reason to tie your identity to your age, would create and hold public keys corresponding to your identity. Now you try to access an age restricted site like PH. You enter in an identifier matching a public key, but probably in some human friendly format like a username, and the website encrypts a packet containing: (randomChallenge, minAge, maxAge?, t, f , contentPub) with the public key. t and f are random values. Though it is encrypted for your public key, and the corresponding private key is known by the authority, the website you're accessing does not send this directly to the authority, but the package is sent to your device directly. You then open your "Age Verifier" app and pass the data packet on and validate your identity with a 2FA code in a standard scheme. The authority decrypts the packet. If your identity's age is within the min-max range, it XORs the randomChallenge with t. If it is not, it XORs it with f. It encrypts the result with contentPub, the public key belonging to the content you're trying to access and sends the result back to you so you can pass it on to the content. Assuming I haven't made any mistakes here, only the authority can do the t/f XOR challenge on decrypted content (depending on encryption scheme we can replace with multiply, add, exponentiate or whatever) and only the content holder can decrypt the result and the answer of course should not be malleable to flipping t and f. To prevent that we probably need the original packet to contain another value "o" representing the ordering of the other variables so t and f are not always the same bits in the encrypted package.
With this scheme, the content doesn't learn anything about you, not even your actual age, only whether you're within the allowed range or not. The authority doesn't learn what page you're trying to visit assuming the public key of the content holder is generated per-request, and the authority should be trusted. Two issues remain. The authorities get to know how frequently you try to access age-gated content which can also be seen as a privacy violation, and the content holder can possibly join up with other content providers to map your public key's activities to you. Here's how I propose to solve that.

1) As part of standardising this technology, all OS vendors put in daemons that continually make request up. All HTTP(S) requests come with an attempt following a valid but unused execution of the above protocol. As all requests are now effectively age-gated it no longer really means anything. Note that 2FA is not required here. Since the answers to the requests don't matter and the protocol can be made such that the authority sends its result package and 2FA request in one single message with the result only being accessible after 2FA'ing it, it cannot tell the difference between a 2FA unlocked request and a one shot ignored request.

2) After every request, a new public key is generated for your identity. The exact algorithm for it can be anything really as long as content providers cannot deterministically guess it, but it could incorporate the challenge from the prior request and your 2FA code as well as username




Just a quick off the top of my head idea for what it could look like. Then we just need regulation requiring certain types of content to use this standard. - Alternatively we could just use the already existing parental control features in modern operating systems, standardise those and require web content to ask the OS about parental control levels and just make parents setup those parental control systems

While, I agree that something like this needs to be achieved there is no way I want my real identity in the same zip code of my identity, with any Porn site and I suspect that I am not alone. As grimy as some of the fetish content is an these sites, the people who run them are just as slimy and untrustworthy. I actually met an individual who ran a large porn board at a tech conference about 20 years ago. I felt like I had to take a shower after talking with them for only 5 minutes.

As a parent, I can understand the overall reasons for the ban. I remember in the early 2000s, my Ex went off on me because of the browser history (Porn) on the family iMac. I completely denied it because 1. I wouldn't use the family computer for such endeavors, and 2. I knew how to cover my tracks. Turns out it was my tween middle daughter who innocently googled "why are some girls boobs bigger than others", three clicks in... I cannot imagine being a parent today.

 

[casperes1996]

While, I agree that something like this needs to be achieved there is no way I want my real identity in the same zip code of my identity, with any Porn site and I suspect that I am not alone. As grimy as some of the fetish content is an these sites, the people who run them are just as slimy and untrustworthy. I actually met an individual who ran a large porn board at a tech conference about 20 years ago. I felt like I had to take a shower after talking with them for only 5 minutes.

As a parent, I can understand the overall reasons for the ban. I remember in the early 2000s, my Ex went off on me because of the browser history (Porn) on the family iMac. I completely denied it because 1. I wouldn't use the family computer for such endeavors, and 2. I knew how to cover my tracks. Turns out it was my tween middle daughter who innocently googled "why are some girls boobs bigger than others", three clicks in... I cannot imagine being a parent today.

Fully agree, hence why I proposed a solution that would avoid any identity information being shared with the content vendors, regardless of what content that is, yet still provides a chain of trust to the user's reported age.

 

[Eric]

Thing is, age-gating some content in the digital world does make sense. But there's a lot of problems with the way we can achieve that at present, privacy being one of the major ones. What methods do we use to validate a user's age without needing too much information from them other than age, yet being able to trust the answer we get? Ignoring pornography there's a wealth of other use cases; Gambling websites (although by nature of requiring a credit card to begin with there's some inherent protection there), and similar content that in the physical realm we age-gate. Perhaps there's a reasonable need for a standardised approach to age restrictions and parental control systems across all computing vendors with regulatory backing.

Imagine a system where a central authority, or perhaps a series of decentralised authorities, vouch for your age. Places like government portals, banks, and other entities that already have a legitimate reason to tie your identity to your age, would create and hold public keys corresponding to your identity. Now you try to access an age restricted site like PH. You enter in an identifier matching a public key, but probably in some human friendly format like a username, and the website encrypts a packet containing: (randomChallenge, minAge, maxAge?, t, f , contentPub) with the public key. t and f are random values. Though it is encrypted for your public key, and the corresponding private key is known by the authority, the website you're accessing does not send this directly to the authority, but the package is sent to your device directly. You then open your "Age Verifier" app and pass the data packet on and validate your identity with a 2FA code in a standard scheme. The authority decrypts the packet. If your identity's age is within the min-max range, it XORs the randomChallenge with t. If it is not, it XORs it with f. It encrypts the result with contentPub, the public key belonging to the content you're trying to access and sends the result back to you so you can pass it on to the content. Assuming I haven't made any mistakes here, only the authority can do the t/f XOR challenge on decrypted content (depending on encryption scheme we can replace with multiply, add, exponentiate or whatever) and only the content holder can decrypt the result and the answer of course should not be malleable to flipping t and f. To prevent that we probably need the original packet to contain another value "o" representing the ordering of the other variables so t and f are not always the same bits in the encrypted package.
With this scheme, the content doesn't learn anything about you, not even your actual age, only whether you're within the allowed range or not. The authority doesn't learn what page you're trying to visit assuming the public key of the content holder is generated per-request, and the authority should be trusted. Two issues remain. The authorities get to know how frequently you try to access age-gated content which can also be seen as a privacy violation, and the content holder can possibly join up with other content providers to map your public key's activities to you. Here's how I propose to solve that.

1) As part of standardising this technology, all OS vendors put in daemons that continually make request up. All HTTP(S) requests come with an attempt following a valid but unused execution of the above protocol. As all requests are now effectively age-gated it no longer really means anything. Note that 2FA is not required here. Since the answers to the requests don't matter and the protocol can be made such that the authority sends its result package and 2FA request in one single message with the result only being accessible after 2FA'ing it, it cannot tell the difference between a 2FA unlocked request and a one shot ignored request.

2) After every request, a new public key is generated for your identity. The exact algorithm for it can be anything really as long as content providers cannot deterministically guess it, but it could incorporate the challenge from the prior request and your 2FA code as well as username




Just a quick off the top of my head idea for what it could look like. Then we just need regulation requiring certain types of content to use this standard. - Alternatively we could just use the already existing parental control features in modern operating systems, standardise those and require web content to ask the OS about parental control levels and just make parents setup those parental control systems

Well said and good ideas. I think we all agree that there should be some verification but it's just not possible without a huge invasion of privacy. There's a big difference between simply showing the doorman or porn store clerk your ID and submitting it to a site that will surely track and log it, even if the technology is/will be there I don't think the trust is.

 

[rdrr]

Fully agree, hence why I proposed a solution that would avoid any identity information being shared with the content vendors, regardless of what content that is, yet still provides a chain of trust to the user's reported age.

I imagine there would be a huge payday for someone to create this. People want their porn, but don't want their neighbors knowing their fetishes. And everyone wants to keep it out of the hands of children.

 

[casperes1996]

I imagine there would be a huge payday for someone to create this. People want their porn, but don't want their neighbors knowing their fetishes. And everyone wants to keep it out of the hands of children.

I imagine there would be a huge payday for someone to create this. People want their porn, but don't want their neighbors knowing their fetishes. And everyone wants to keep it out of the hands of children.

The technology to achieve it definitely exists. But there's some major requirements and caveats to my proposed solution that make it practically infeasible for non-technical reasons.

For one, all parties would have to participate. That is all major OS vendors and browser vendors, Google, Mozilla, Apple, Microsoft, The Linux Foundation/community, etc. Also the content providers, so all the sites offering adult contents would have to participate and implement their side of the handshake. And for them to do that they need incentive, which means there needs to be a regulatory requirement, and if it's just a handful of states; Even 17, they're not important enough to push the needle on such a huge initiative; It basically needs to be all of EU + all of US to create the required infrastructure for my main proposal. All built on existing cryptographic primitives, but we'd still also need the concrete cryptographic details ironed out and prove it safe from Byzantine actors for the chain of trust to make sense from both the perspective of content vendors and privacy of users.

So technically possible I am certain, but unlikely to happen the way I'd want it to

 

[Herdfan]

Pornhub pulls out of Florida, VPN demand 'surges 1150%'

State masks up finally – its IP addresses, that is

www.theregister.com

So can a VPN fully bypass the restrictions?

 

[Eric]

So can a VPN fully bypass the restrictions?

Absolutely, this is the exact sort of thing it was designed for. Regardless of this issue it's your right to browse the internet privately, IMO everyone should be using it at all times, I pay an annual subscription to Nord VPN and it's worth every cent to me.

 

[rdrr]

So can a VPN fully bypass the restrictions?

Asking for a friend?

Kidding! I believe so, but on a VPN sometimes it can reduce the quality of streaming.

 

[casperes1996]

Absolutely, this is the exact sort of thing it was designed for. Regardless of this issue it's your right to browse the internet privately, IMO everyone should be using it at all times, I pay an annual subscription to Nord VPN and it's worth every cent to me.

Just an FYI that VPNs don't really offer that much more privacy. Your GEO location can appear different and your IP not be traced as easily, but your VPN provider gets all your network traffic channeled through it. HTTPS still means that for the majority of sites they can't see the site content you receive, but they can see all the DNS requests you make, meaning you're just swapping out trusting your ISP with trusting your VPN provider with all your domain name resolution queries.

 

[Eric]

Just an FYI that VPNs don't really offer that much more privacy. Your GEO location can appear different and your IP not be traced as easily, but your VPN provider gets all your network traffic channeled through it. HTTPS still means that for the majority of sites they can't see the site content you receive, but they can see all the DNS requests you make, meaning you're just swapping out trusting your ISP with trusting your VPN provider with all your domain name resolution queries.

Right but it's the masking of IP and geolocation that's key to all of it and it works as designed, I agree that it's only as good as your trust with the provider. I think of it like the iPhone, I have full faith in their security and any company risks a lot if they blow that trust. Nord is pretty reputable.