hckrnws

Brilliant. They're repackaging the argument governments have long made about E2EE being dangerous to children.

Children are just too effect of a tool when building a surveillance state. We should have banned children from owning open computers a long time ago just like we do with Alcohol, Driving licenses, etc.

Instead children would own special devices that are locked down and tagged with a "underage" flag when interacting with online services, while adults could continue as normal. We already heavily restrict the freedom of children so there is plenty of precedent for this. Optionally we could provide service points to unlock devices when they turn 18 to avoid E-waste as well.

This way it's the point of sale where you provide your ID, instead of attaching it to the hardware itself and sending it out to every single SaaS on the planet to do what they wish.

Would be a nightmare to implement and achieve the goal, but I have to say I think it’s more right than wrong. All of the data is very clear about the harms.

China has restrictions for social media and screen time for kids — how do they implement this?

I actually think this would be easier to implement than many of the current ID verification methods I've seen being pushed. We already have the infrastructure for selling age restricted goods, this is nothing new. Manufacturers that are unable to restrict their hardware in a "child" mode don't have to do anything and could simply continue selling to adults only.

It's obvious we're moving in a direction where we are going to get these restrictions in one way or another, and this is the only way I've come up with that doesn't come with serious privacy implications.

Most importantly, this solution would be simple for anyone to understand. You don't need to be a cryptography expert to understand there are child safe devices and then there are unrestricted devices for adults.

Would the parents comply though? Many of the restrictions work because most adults agree is OK. For example for alcohol, children could drink as much as they want at home, if adults would permit it.

If most adults would be convinced there is an issue, one probably has enough lock-down modes even nowadays, not sure it is a "technical" problem.

I don’t understand how id-ing the buyer helps? What is the age restricted good here?

Are you saying that kids now buy their phones with pocket money without their parents knowing?

> It's obvious we're moving in a direction where we are going to get these restrictions in one way or another

It’s not obvious, it’s just sad. I still hope reason will prevail in this.

Passport /citizen ID linked to your WOW account, etc.

Which has never worked. Korea had a system to prevent kids from gaming after midnight for something like 15 years. All it did was make Korean kids very good at memorizing their parents ID.

Parents are already allowed to restrict their children access to 'dangerous' things like open computers or knives.

Parents are also allowed to restrict their children access to alcohol and cigarettes, but it seems a government ban on them buying those things works better

I don't think debazel was saying that children should have been banned from owning computers for the benefit of the children. He was saying that children should have been banned from owning computers so that the government would have no excuse to regulate what's allowed on computers.

Locking down children’s devices doesn’t stop adults sharing illegal content with other adults though, so there would still be pressure to monitor communications between adults.

At some points, laws become an ineffective tool to prevent malevolent people to act in detrimental manners, no matter what it states. But prejudices of wicked states will always continue to impact more badly general public as ever more drastic laws lacking any balance become enacted.

I don’t think they’re doing that on TikTok

At the same time, I remember growing up in the internet's wild west and bad encounters weren't an issue for me because of the golden rule I was taught from the start: you don't give your personal information and you don't interact with complete strangers. Learning to navigate the web instead of being in a walled garden was helpful in many ways.

The better question to ask ourselves is, does the capability to gather more information also lead to more power to act on this information? If the investigative resources are spread thin already it's not like they're gonna catch more criminals with investing more there. Repelling questionable individuals off the platform with lots transparancy -is- an effective way, but just a specific tool for a symptom.

I think a part of a better solution is to give parents and children better tools to manage their social graph themselves. Essentially the real problem is discovery and warding off of social outliers in a way that doesnt out all responsibility on opaque algos or corporations.

A part of their e2e keys could be shared using an intentionally obtuse way like mailing an item or a physical "friend code". That way parents and vetted friends can have their privacy. You don't need to tie an id to someone's person to get positive confirmation on someone's poor behaviour. If someone crossed the line then parents can see it and escalate. In additon, what would happen to a child with abusive parents who can then arbitrarily restrict and deny a childs freedom to communicate? I did not have this myself, but without free access to other minds and information I would have been duller. Does a large information dragnet really serve our collective interests or are more precise tools needed?

> I think a part of a better solution is to give parents and children better tools to manage their social graph themselves. Essentially the real problem is discovery and warding off of social outliers in a way that doesnt out all responsibility on opaque algos or corporations.

This is actually a key consideration for the proposed implementation. The biggest issue for parents when restricting their children's online activity is that they simply don't understand the tool available for it.

By having a "child mode" iPhone, parents don't have to know any of that. They simply buy the iPhone Kids for their children and then get a plain iPhone for themselves.

If these restrictions were to actually be enforced by law as well, then it would make it very easy for teachers and other guardians to check if a device is appropriate for the child using it.

From what I've seen, the bad effects don't necessarily just come from free access to the internet, but that everyone around them in their social group has a video camera that can covertly record, they're all immature children and thus you cannot slip up once or you get kid cancelled, and they start doing a collective dissociative freeze response in a self-imposed emergent panopticon as a result.

So if the teen phone turned into a restricted "call mom" device with no cameras and with neon yellow obvious fuck you coloring and a restricted set of apps, and police took away a full phone much like they take away cigs and beer it might be enough to break the critical mass to create this issue. They can have dedicated cameras for video club, use the family computer, have an xbox or switch and have whatever tech experience that millenials had, the last generation to not have exponential increases in anxiety , depression and sexlessness.

It's the covert camera + internet that it's the key issue.

This honestly sounds like the best proposed solution I have heard.

Agreed. Putting the burden on parents is quite something:

1. You end up being the bad guy, other parents don't restrict their kids internet usage etc. Some folks would argue to just not set up restrictions and trust them. But it's a slippery slope and puts kids in a weird position. They start out with innocent YouTube videos, but pretty quickly a web search or even a comment can lead them to strange places. They want to play games online, but then creeps abuse that all the time. Even if you trust them to not do anything "wrong", it's a lot to put on their shoulders.

2. If you want to put restrictions in place, even if you're an expert, the tools out there are pretty wonky. You can set up a child protection DNS, but most home routers don't make it easy (or even allow you) to set a different DNS server. And that's not particularly hard to circumvent. I suppose a proxy would be a more solid solution, but setting that up would be major yak shaving. Any "family safety" features (especially those from Microsoft) are ridiculously complicated and often quite buggy. Right now, I got the problem on my plate that I need to migrate one of my kid's accounts from a local Windows account to a Microsoft account (without them loosing all their stuff), because for local accounts, it seems the button to add the device is just missing? Naturally, the docs don't mention that, I had to do research to arrive at that hypothesis. The amount of yak shaving, setup and configuration you have to do for a reasonable setup is just nuts.

3. If you're not good with tech - I don't see how you have _any_ chance in hell to set up meaningful restrictions.

Some countries are banning social media - sure, that's one thing. But there's a _lot_ of weird places on the internet, kids will find something else. I for one would appreciate dedicated devices or modes for kids < 18. Would solve all this stuff in a heartbeat.

> Instead children would own special devices that are locked down and tagged with a "underage" flag when interacting with online services, while adults could continue as normal.

California is mandating OSes provide ages to app stores, and HN lost their mind because it's a ban on Linux.

> California is mandating OSes provide ages to app stores,

They forgot to put in the provision which exempts apps which do not need an age rating? As in: everything os related.

Sounds like a good way to get rid of snap at least since that is where all the commercial bloat is located. Last time I did a fresh Debian install I do not remember installing any app from the os repository which would require age restrictions (afaik).

> They forgot to put in the provision which exempts apps which do not need an age rating? As in: everything os related.

That's correct. You need to provide your age to install grep.

> We should have banned children

I see you Mr Quaker Oats

I can't tell if this is sarcasm or not

TikTok has a drug-like effect on the brain. Multiple studies show a clear link between excessive TikTok engagement and increased levels of anxiety, depression, and stress. Maybe it is time we regulate it like a drug?

Is that because of engaging with tiktok, or because of the content on tiktok? If the app was exclusively pictures of kittens and nice flowers you saw on your commute, would it have a detrimental effect?

What do you mean exactly, tax it as a vice?!

Hyperbole of some sort. I think it works on both the positive and negative side of the axis too.

I’ll have a packet of cigarettes, a fifth of vodka, and an unrestricted personal electro device.

ID please.

Seems entirely reasonable.

Possibility entirely ineffective, but then again I don’t often see children walking around with bottle a of booze.

This is how the internet is run in countries where you need ID to connect to services. It’s not at all dystopian.

TikTok is the government, morealess

I don't understand why all teh child safety systems require age verification. Why not have a single setting on a smartphone that sends a 'child' flag to every single app or website, which then reacts accordingly? As long as you ensure that the browser can't be changed or modifed, it should be fine.

Ultimately your neighbors must buy the argument. The reason why this argument wins is not because framing is so tricky, but because it connects with the values of your neighbors. Trying to convince people that these aren't actually their values is swimming upriver.

The solution is simple: Take away the argument by blocking children's access to social media. Win-Win.

DMs are akin to private conversations in real life. Thus, every DM feature should entail E2EE.

It’s ok for a platform to not feature private conversations. They should just have no DM feature at all, then; make all messages publicly visible.

Private conversations are indeed not for all ages. Parents should be able to grant access to that on individual basis.

Ah, but you see, soon TikTok will allow parents to spy on their children's DMs, and parents will love this.

You could have reasonable legal system where privacy is guaranteed. But you do not need end to end encryption for that to be thing. It really is orthogonal issue.

It doesn't matter. Web-based cryptography is always snake oil

https://web.archive.org/web/https://www.devever.net/~hl/webc...

> if the server operator was malicious, they could just push different client-side JavaScript

Same as with OS updates, browser updates, dependencies used by the OS, dependencies used by the browser. Also you can run malicious software such as keyloggers and you're compromised.

That argument doesn't mean E2E (even web based) is snake oil. Browsers just give you more points of failure.

Agree, but a significant point missed in the article is that of data vulnerability. with E2EE the company db is useless to an external attacker.

For some companies (eg facebook, google, tiktok) i would be mostly worried about the company itself being untrustworthy. For others I would be mostly worried about the company being vulnerable.

It's a native app what are you talking about

TikTok is a front for government surveillance, so it's not really surprising that this is their position.

[dead]

This might be off-topic but on-topic about child safety... but I'm surprised people are being myopic about age verification. Age verification should be banned, but people ignore that nowadays most widely used online services already ask for your age and act accordingly: twitter, youtube, google in general, any online marketplace. They already got so much data on their users and optimize their algorithms for those groups in an opaque way.

So yeah, age verification should be taken down, as well as the datamining these companies do and the opaque tunning of their algorithms. It baffles me: people are concerned about their children's DMs but are not concerned about what companies serves them and what they do with their data.

> people are concerned about their children's DMs but are not concerned about what companies serves them and what they do with their data.

Hogwash.

Where are these mythical people who aren’t concerned with both?

I thought it was common knowledge to just set your birthdate to 1970 or something

You can make it a nice round 2000 these days.

Monitoring children's DMs is the responsibility of the parents, not megacorps. If a parent wants to install a keylogger or screen recorder on their child's PC, that's their decision. But Google should not be able to. Neither should... literally anyone else except maybe an employer on a work-provided device.

> Monitoring children's DMs is the responsibility of the parents, not megacorps.

Yup, but the tools provided make that easy or hard.

But putting that emotive bit to one side, Megacorps have a vested interest in not being responsible to children. They need children's eye balls to drive advertising revenue. If that means sending them corrosive shit, then so be it.

Its a bigger issue than encryption, its editorial choice.

> Monitoring children's DMs is the responsibility of the parents, not megacorps

Absolutely. But what responsibilities do megacorps have? Right now, everyone seems to avoid this question, and make do with megacorps not being responsible. This means: "we'll allow megacorps to be as they are and not take any responsibilities for the effects they cause to society". Instead of them taking responsibilities, we're collecting everyone's data and calling it a day by banning children from social networks... and this is because there are many interests involved (not related to child development and safety).

> But what responsibilities do megacorps have?

fake and scam AD.

they literally profit from those ADs. When the AD distributes malware or make scam, they don't take any responsibility

> But what responsibilities do megacorps have? Right now, everyone seems to avoid this question

Clear, simple, direct: Whatever was required of The Bell Telephone Company and nothing more.

So there should be a human operator manually gatekeeping every individual request to connect with another endpoint?

It's a good thing those human operators couldn't listen in to whichever conversation they wanted.

Human operators were not required of The Bell Telephone Company by law. Bell switched to mechanical switching stations as soon as doing so was economically advantageous.

(Reconsider my post. I'm arguing for no regulation.)

I'd say that at minimum social networks need to be required to show how their algorithm works and allow users control over their data. They must be able to know why a content was served to them. Nowadays social networks are so pervasive in society, affecting it and molding it to unknown interests, that this is the bare minimum for a free society.

Ideally, users should be able to modify the algorithm, so they can get just what they want, while simultaneously maximizing free speech. If something isn't illegal, it shouldn't be hidden or removed.

> social networks need to be required to show how their algorithm works

Hypothetically speaking: What if it's a neural network in which each user has his/her own unique weights which are undergoing frequent retraining?

Would it not be an undue burden to necessitate the release of the weights every time they change?

Also, what value would the weights have? We haven't yet hit the point of having neural networks with interpretability.

Wouldn't enforcing algorithmic interpretability additionally be an undue burden?

> They must be able to know why a content was served to them.

What if the authors of the code are unable to tell you why?

The use of black boxes like neural networks is already effectively illegal in some governments for this very reason.

I don’t remember reading about ads in phone calls, nor the complete mapping of customers behaviors to use in contexts not being the phone call.

The apples to oranges in this comparison is probably top five on HN ever.

> But what responsibilities do megacorps have?

They should have a responsibility of transparency, accountability and empathy towards users. They should work for the user and in the interests of the user. But multiple constraints make this impossible in practice.

Mega corps should be compelled to and rewarded for allowing parents to monitor their children’s dms.

> maybe an employer on a work-provided device.

The children yearn for the mines(?).

Parents shouldn't give their child access to a device that allows DMs.

That said, these platforms are making it impossible for parents to monitor anything. They're literally designed to profit off addiction in children.

Why? Plenty of children benefit from talking to other people. Some children need careful monitoring, and some children shouldn't be allowed to use DMs, but it's not universal and should be up to the parents.

> Age verification should be banned

Why?

> They already got so much data on their users

There are a variety of ways (see "Verifiable Credentials") that ages can be verified without handing over any data other than "Is old enough" to social media services.

Age verification obliviates anonymity on the internet. If everything you do, _can_ be tracked by the government, it _will_ be.

Allowing for more effective propaganda, electrol control, and lights a fire on the concept of a government _representing_ anyone.

> Age verification obliviates anonymity on the internet.

How so?

Please explain in detail, because there are already schemes such as "verifiable credentials" which allow people to prove they are of age without handing over ID to online services.

because most implementations are not going to be like that.

In the context of "Age verification should be banned" though, we're already talking about legislative intervention. If there's no particular problem with schemes that are like that then we don't necessarily need a blanket ban on age verification.

Perhaps what we're really saying is "Ban age verification that collects lots of personal information".

Or perhaps we could distil it down further to "Ban unnecessary collection and storage of PII". In which case, Congrats! You've arrived back at the GDPR :)

Which I think is a good thing, and should be strengthened further.

(Also the other response to "because most implementations are not going to be like that" is "why not?". People are already building such ecosystems.)

Ok, and? Presenting your ID at a number of IRL estamblishments also heavily reduces anonymity

The difference is that IRL establishments don't sell off that data to anyone else, nor do they have the ability to collate that data with data from other establishments to make a profile of you.

(at least not yet)

It's a slippery slope.

This is the next two steps into 1984.

Once you start mandating this, there's no going back.

The next generation will start associating wrongthink with government IDs. (Wait, we already do that, right?)

> It's a slippery slope.

Is it? I thought that was a logical fallacy?

> This is the next two steps into 1984.

How so?

> Once you start mandating this, there's no going back. > The next generation will start associating wrongthink with government IDs.

Could you provide some more details on why you think this? For a start I talked about a scheme in which you don't hand over ID.

Slippery slope can be argumental if you provide the actual argumental reasoning for it as I was thought it could be used as deductive argumentation (though that does not say much). On itself it is a fallacy.

I don't see how verifiable credentials with zero knowledge proofs provide that however.

The Party doesn't care about the Proles, only the members of the Outer Party.

I think that it's rather funny that people like to appeal to 1984 as if the only point of Mr. Orwell was that surveillance is bad, missing the entire point about stuff like the control of the language or the idea that the only self-justification of the (Inner) Party is power for the sake of power (see also: The Theory and Practice of Oligarchical Collectivism).

I'd even go as far as to say that if "telescreens are horrible" is the only thing that someone takes away from 1984, they've frankly missed the point.

Read another book.

Maybe just don't use TikTok. Shocking that adults use a platform for children.

I take privacy suggestions from social media companies on a daily basis.

Just like door locks are making the world less free!

Why would you use TikTok for private communications anyway? It's mostly a public short video sharing platform.

It's the kids' social network, you're just old.

> you just have intact brain

Fixed a bit.

As much as I want to agree with you, the people who like TikTok make up a significant amount of the population, and their opinions do matter--arguably more than yours, due to sheer numbers.

Smugly dismissing them doesn't do you any favors except for making you feel good about yourself for a few seconds.

[dead]

The way it starts is you pass videos back and forth with a friend. Then you find yourself chatting in the same app.

I'm mindful that it's less secure than other apps, but for a lot of chats it doesn't matter.

Says someone who has never sent a message to a friend over DM on TikTok.

Thankfully

Hopefully

Exactly.

You say that like the typical 18 year old has any idea what they're doing when it comes to proper encryption and communication safety. That is never going to be the case.

It's a communication channel attached to the most popular social network for young people. Obviously they're going to use it a lot. They use it for the extreme convenience.

>never going to be the case.

And in a perfect world essentially shouldn’t have to be, at least inside expensive walled garden app stores.

They might understand e2ee but not care.

it's more than that.

I hate the BBC so much - "controversial privacy tech" "E2EE ... the best way to protect conversations from .. even repressive authorities" "End-to-end encryption has been criticised by governments, police forces"

They're saying this at the same time as they're clutching pearls over Iran's repression of protestors. Typical of the ethical consistency I would expect from them.

I feel like this makes sense for a platform that targets teens. Plus, I wouldn't trust TikTok to implement E2E encryption properly—who knows what they've snuck into their client.

What kind of application is not targeted at both teens and adults?

Youtube, twitter, bluesky, whatsapp? Every app with a social aspect will be used by teens. And no, tiktok is not "only for teens" or "specially targeted at teens", nowadays everyone uses it and creates content on it.

Came here to post this.

If you run (say) a restaurant, you get big spikes in business from TikTok videos in ways you don't get from Facebook or Instagram or others.

TikTok is the platform everyone is one right now.

I think it's very safe to assume that no major US based platform has 'real' E2E encryption. They're almost certainly all a part of PRISM by now, and it'd contradict their obligations to enable government surveillance. So the only thing that's different is not lying about it. Though I expect the other platforms are, like when denying they were part of PRISM, telling half truths and just being intentionally misleading. 'We provide complete E2E encryption [using deterministically generated keys which can be recreated on demand].'

Signal is open source

Snowden endorsed last I heard? He doesn’t email of course.

Doublespeak. War is peace.

Do you feel safer knowing DMs are not encrypted?

Nobody should feel safe using the TikTok client, period.

Not just the TikTok client, anything made by Oracle is risky.

Neither Instagram/Facebook's Messenger/WhatsApp.

And signal

What do you use for messaging?

Obviously carrier pigeons carrying messages encrypted with post-quantum ciphers where keys have been sent ahead of time using USPS because no one would be so rude as to read someone elses mail.

I have been using simpleX for some time now.

Do you take "yes" for an answer?

It really depends on whether you think your government is more dangerous than, say, suicide trends, grooming, scamming.

I know the answer is pretty easy for US citizens to answer right now.

And their target audience won't question it.

There is no way to do E2EE on a traditional social media platform with user-generated content and comply with existing US law.

You can’t moderate an E2EE platform.

All of Meta’s major properties (Messenger, Instagram, WhatsApp) support E2EE messaging.

Pretty sure that for Meta the impossibility to moderate E2EE was the point. It’s cheaper to shrug than pay content moderators.

What law do you believe supports your perspective?

Aside from the fact that you can get Metadata and that some communication frequently happens outside of E2EE - what US law do you believe mandates moderation? I'm curious.

unrelated but I'm always surprised by the number of people who don't know that instagram dms are not encrypted by default.

Since when is E2EE controversial? Not using E2EE should be controversial.

It's never been controversial, it's the BBC. doing it's usual job of laundering the arguments the establishment want you to hear for domestic consumption.

Fun fact - there is a big correlation between World Wars and compulsory education. Of course governments and big corporations "care" about children. Of course!

Reminder, Larry “citizens shouldn’t get any privacy” Ellison now owns tik tok. If you’re still using it or have friends and family using it you should stop immediately. It WILL eventually be used against you if this regime gets its way.

https://digitaldemocracynow.org/2025/03/22/the-troubling-imp...

As if. If people haven't stopped using TikTok with all of the other reasons for stopping, then because Ellison is damn sure not going to move the needle.

What were the other reasons for stopping?

Curbing addiction?

The core tension here isn’t really about encryption itself, it’s about moderation models.

Most large platforms rely heavily on server-side visibility for abuse detection, spam filtering, recommendation systems, and safety tooling. End-to-end encryption removes that visibility by design. Once a platform is built around centralized analysis of user content, adding strong E2EE later isn’t just a feature toggle — it conflicts with large parts of the existing architecture.

Fascinating. What a time to be alive.

clown emoji

It's the Max app for Americans, now with 900% more US and IL government spying.

why are we still wringing our hands around this? we’ve already determined that tiktok is bad for our health.

because tiktok is addicting, and they know it…

> Grooming and harassment risks are very real in DMs [direct messages] so TikTok now can credibly argue that it's prioritising 'proactive safety' over 'privacy absolutism' which is a pretty powerful soundbite

Means they read every message

BBC calling encryption "controversial privacy tech" is deeply disappointing and dangerous.

I wondered how it could be considered 'controversial', but they do quote at least a couple groups speaking against it. The NSPCC for instance, who incidentally also warned parents about a Harry Potter video game because their children might want to learn more about the game:

>“Parents should also be aware that players may want to find out more about the game using other platforms such as YouTube, Twitch, Reddit and Discord, where other game fans can discuss strategies and experiences.

It is controversial.. amongst people who have concerns about private communications and society, from a regulatory and governance perspective.

It's uncontroversial amongst people who value their privacy.

The tension between the two camps (there are obviously nuances and this is a false dichotomy) is at a current peak. It's an ongoing controversy. It's a matter of public debate.

You might have liked it better if the angle had been "...which the government, controversially, wants to clamp down on" or something.

Calling something controversial is a favorite propaganda technique employed by "news" outlets. It's another form of selective reporting and framing. It carries negative connotations, and has really no objective standard by which it can be wrong since you'll always find somebody against any issue.

After you notice it, you'll notice it everywhere.

The UK government seems a lot more willing to embrace the panopticon in the name of protecting people from terrorists, child sex traffickers, human rights activists, Catholics, jaywalkers, you name it.

[flagged]

Thanks for letting us know, 53 days old HN account!

"The situation is made more complex because TikTok has long faced accusations that ties to the Chinese state may put users' data at risk."

And yet, it's even more complex than that, since it's now owned by cronies of the current US President. I've never had a TikTok account, but conceptually I was mostly pretty okay with being spied-upon by China. I'm never going to China.

> I'm never going to China.

China will come to us.

Or should that be:

China will come to the US.

> "I'm never going to China."

Voluntarily.

Yes. China gives a shit that user rdiddly, at 36 minutes before 00:55 UTC on March 4, 2026, said that China is spyihg to the point that they are going to be abducted for it.

TikTok’s stance against end-to-end encryption is unsurprising but still concerning. TikTok is a source of information on many topics, such as the genocide in Gaza, which traditional media underreport and many governments try to suppress. The network effect of big social media platforms means many people will likely talk about these topics in TikTok DMs. No matter what legal controls TikTok claims to enforce, there is no substitute for technological barriers for preventing invasions of privacy and government overreach. This is yet another example where corporations and governments sacrifice people’s autonomy and privacy in the name of security.

It's a pretty terrifying world we live in now, where an unencrypted addictive short-form video platform is considered a source of information more than news agencies or even community-managed forums.

For older generations Facebook has the same problem. "On Facebook it said [propaganda item bla bla]" is something I hear with those generations.

Of course you are the target audience for disinformation spread via this propaganda platform.

[dead]