Upcoming Changes for Adult Content: Account Verification for Accessing Adult Content

Oddly it was another kind of Indy that leapt to mind after reading the blog post, something to do with a Temple of Doom

Thats what I'm wondering to...

actually we have nothing to worry about period. we went through this a year ago and LL was forced to abandon thier plans then. they will be this time too. unless LL really wants to violate the court rulings?

seriously. if you really think you can get around those rulings think again. judges have a lot of discression when they find someone in contempt. and if thats not enough incentive think of all the lawsuits you'll get from hose that dont want thier personal info accessed or accessable. because i'll be one of them. LL leaked my info once.

This is not really true. The XStreet restriction is on VISUAL depictions of sex or genitalia. You are perfectly free to advertise any and all sex or genital products on the front page of XStreet as long as they do not VISUALLY depict sexual acts or genitalia. If you are going to restrict access to adult content then XStreet needs to change its policy.

Okay .. I think I'll be off. Hope I'm wrong but this smells like a(nother) phony consultation exercise on something that's already been decided.

In this case it sounds a bit like, "would you prefer to be kicked in the teeth by the Nazi in the black uniform or by the nice policeman in the blue uniform?"

Obviously no-one in LaLa land is interested in hearing input like "it ain't broke and don't need fixing".

However, on the off chance .. surely the minimum impact approach would be to build a new continent just for corporate suits and Disneylanders. You could call it .. oh .. PC Grid. You could then make it off limits to all the nasty people like me. In fact, please, make it off limits to all the nasty people like me .... Now everybody is happy. What's so hard about that?

So, as long as we use a credit card to pay our bills with Lindens we are "age-verified"? Fair enough - can you categorically state that? How will this verification be accessed or granted?

"actually we have nothing to worry about period. we went through this a year ago and LL was forced to abandon thier plans then. they will be this time too. unless LL really wants to violate the court rulings?"


Is that so? Do tell! Where isthe literature on this? I would be interested to read up on that. Thanks.

Porn sites and Yahoo seem to regard that as sufficient. Does something make SL a special case?

The reason they stoped it was because the residents.. ie customers threw a fit.. and if it doesnt happen this time also.. we WILL get this junk

A prediction...

No matter WHAT the residents say in these discussions, the LL bulldozer will still carry this proposal through. No matter how many people leave. No matter how loudly we scream...

They will do just as they did with Voice Chat and other "great ideas" that they were already sold on before they ever gave even lip-service to "listening to the customers". Tey will do whatever they please, even if it is 180 degrees opoposite to what the Residents claim they want.

Are you telling me, that since Sensual Stoneworks is on a private island, none of this adult verification process applies to us? That we can list as adult WITHOUT having to ban those unverified?

Or will we be invisible on the map and search?

Explain how this works, please?

"If you could link (behind the scenes) to your alt for verification, would that work better for you?"

YES YES YES! This is what everyone has been asking for for years! Why are you even asking?!

I think this is foolish. What we're seeing is merely the influence of prudish morality. We already have PG/Mature. We do not need a third rating category. While estates will not be affected much by this, the mainland is going to get screwed. If you own an adult store on the mainland, you will have to sell your land and move. The mainland is very different from an estate.

Identity-based verification is foolish, and in many countries/some American States, illegal. Aristotle will not be afraid to "leak" our information via a "security incident." To force people to go through them is insane, though it's ncie that they're now an alternative to payment verification, which is not secure either.

You can use anyone's ID to fool Aristotle, and this is likely better than using your own, since they'll probably sell it. That way, you can sleep at night knowing some company doesn't have a bunch of information about you. Payment is easy enough too if you don't want LL to have your credit card number. Go to a store, buy a prepaid VISA/Amex/MasterCard giftcard, and enter that into your account. This latter part isn't against anyone's terms of service, and is completely legal.

Point in case: LL is going to have a hard time separating content further without stepping on a lot of toes, and they cannot stop minors from gaining illegal access to the grid without gross violation of residents' privacy. Deep down, a lot of you know that both of these points are true.

What about the people that have no credit card but still like to explore SL.

Age verification by identity card or driving license, Don’t even waist any penny in investing in that, it is a waste of precious money that can be used in other resources.

Small example,
In my home country there are networking-sites, that need registration by entering your Social security number, so to say, to make it easier to keep the minors separated from the adults.
You know what are loved ones do, they register on those sites when mummy or daddy is watching.
And never use them again afterwards.
When daddy or mummy aren’t watching they are logged in sites without age verification at all and there are much more of these, and they tend to be more profitable as well.

First off, fire Aristotle. Aristotle is not age verification.

Secondly, I have payment info on file. I do have alts. Eliminate the maximum cap of 5 alts and allow all to be named without penalty, and link all avatars together as one account, no more avatar-centric stuff to define what's an account (this also applies to counting how many accounts have logged in in the last 60 days!), so the payment info on file is a blanket thing for every alt an account has.

If it should prove that credit card info or a paypal account is not sufficient anymore (which it is not, since people who are under 18 can easily get either or both, that's no proof of age), you are welcome to inform me of the date and time that a Linden will be coming to my home to visit me in person, and I will have popcorn ready for your visit. I will not give a single piece of my information to Aristotle.

I am an adult, I have already legally complied with your requirement that I say so on signup, and that's the way things are. If somebody here has said they were 18 and they aren't, throw the precious little angel's backside in juvenile hall until they turn 18, they're criminals.

Yes. The whole business is absolutely irrelevant. Nobody announces a policy and then says "oh now you can comment" if they have any intention of doing more than perhaps tweaking a few policy edges. Even if they produce five pointless comment threads. Consultation has to happen before policy is constructed.

About a year ago I had a young lady apply for and get a job as a stripper in my club. I gave her the job based on the fact that she had "Payment Info Used" on her account. I later found out this young lady was only 15 and has very rich parents. She had at least 5 credit cards in her own name at 15. As soon as I found out, I banned her from the group and lands I own, but, point is trying to verify age by using "Payment Info On File" or "Payment Info Used" WILL NOT ALWAYS WORK. Also, many people who have been in SL for a while will have money (lindens) that they earned over the years by having jobs and yet their accounts will say "No Payment Info On File". The two co-owners for my club fit this description. One made her Ls by working as a dancer and the other is a builder/scripter. I know both are above 18 as I have talked to them on voice. However, the point here is using Paypal/Credit Card alone as age verification is not enough...there should be a choice to either verify by the pay info OR age verification. One alone will not work.

...and reading my post above, if there is an illustration of how little LL actually care about opinions expressed on this forums, it is that BBCode has _still_ not been re-implemented. I suppose we should think that the company has a great interest in the forums given that have refused to do that for quite literally years.

Can you please alter the current policy regarding payment info on file to simply "attach" all alternative accounts to your main account. If I need to go verify an alt/ bot each time I need to create one for various activities or holding more groups for land management then I should be able to have one verification covers all. This has a greater impact of increasing the ease of use of my accounts and would also be a step closer to one financial account with me the real person covering all of my accounts so I can easily transfer USD to other accounts to pay tier etc. You really must decouple account from avatar and let several avatars belong to one account. This will minimise impact on existing long-term residents who are simply trying to fit in to new policies.

HELL NO!

I have already been verified through having paid through a creditcard in the past, but what would this do to the people who make a new account?
Or the people with alternative accounts which they use for various reasons?

Age verification through third parties has been more than a little hazardous in the past. Experience has shown that the 3rd parties involved do not understand or want to provide the security needed to preserve a person's private information.

So what's next? First we'll have the XXX-adult stuff moved to the "ghetto" of "Adult Mainland" and then what?
Are we going to see the same happen on the SL Grid as happened in Germany immediately leading up to World War 2? The Jews, if one might recall, were first moved to specific regions as well, before they were deported and slaughtered by the thousands.

Are we going to see Linden Lab moving to a ban on all Adult content that they disprove off after this system is implemented? I feel nothing for a system like this.

How about an age verification method where you're simply asked to sign an (online) disclaimer stating you are 18 years or older and would like to see adult content?
This could easily be made on the Second Life website and would allow people to easily make the choice of seeing adult content or not.

Heck, it could even have a form to fill in if so desperately needed, which might then have to be mailed or faxed to LL if you want to keep track of it.

But I will assure you that using 3rd parties like in the past will undergo severe research by users and any flaws in the privacy policies of these 3rd parties will not only lead to a boycott of this system but will undoubtedly drive PAYING SL residents away from your system.

And for those of you wishing to contact me about my statements; I hardly check the forums at all. I will crosspost this to my blog at http://makitk.eu. You can reply there if needed.

I have three ALTs that I run off of one account, the core account is the onlt one with payment info. Will my other two accounts be denied access to the sims that they normaly paly in?

I own almost all of a sim, this change could cause me to sell the entire thing.

The reason is simple, it's adult in nature, it's mature, but it also has a few shops which help cover the cost of tier.

If only adult verified people can come to my shops they wont do the same amount of business as before, which means more tier has to be covered by me, something I can't really afford.

Or I could split the land up into pieces and have the shops seperate, thus not being part of the adult zone anyone could come to them, but the fact is, people come to the shops because of the adult zone, they are heading to it but must first go through the shops because of thats where they land. So the end result of this is again loss of income, yadda yadda

I suspect there is more to this than what LL are telling us, if the aim was merely to let people not see adult content when they did not want to see it a flag in their preferences would fix that. No need to verify anything, just say "I don't want to see this stuff".

M.

Can this be? *Gasp*

Has Linden Labs duped us yet again? **

Will the Joker kill Robin or will Batman save the day once more?! *Kapow!*


Of course our opinions count...as hits on their blog site and I fear not much else.


Big wheel keeps on turnin...proud avi's keep on burning....and we're rollin...rollin...rollin ona priiiiiim (sung to "Proud Mary"


P.s. I love me some Second Life! (please dont make any more things disappear from my inventory nice Lindens, I'll be good, I promise)

Since Linden Lab is obviously not going to release this any time soon and it has finally been addressed, now seems to be a good time.

I am sorry for not sticking to the guidelines of responsible disclosure and keeping this issue closed for so long (41 days) with very little feedback from LL.

Subject: [Linden Lab/xstreetsl] Unencrypted transmission of passwords, SSL cookie leakage.

Current state
-------------
1. Fixed but customers not informed
2. Fixed but customers not informed

Attack Vector
-------------
1. www.xstreetsl.com
2. www.xstreetsl.com

Attack Precondition
-------------------
1. being able to sniff unencrypted http traffic using one of the
commonly known mechanisms
2. being able to sniff unencrypted http traffic using one of the
commonly known mechanisms

Type of vulnerabilty
--------------------
1. Unencrypted transmission of passwords and privacy sensible data
2. Leakage of session and user cookie out of the SSL connection

Risk
----
1. high
2. high

Impact
------
1. An attacker can gain unauthorized access to passwords and
privacy sensible data. He or she can steel real-world-money
(as in-game and real-world-money are exchangeable).

2. An attacker can gain unauthorized access to privacy sensible
data except the password. But a new password can be set without
knowing the old one. The private email address can also be
set in order to be able to use the "I forget my password"
mechanism at a later date. He or she can steel real-world-money
(as in-game and real-world-money are exchangeable).

The vulnerabilities were discovered shortly after LindenLab
did an announcement asking players to create an account on
xstreetsl. Therefore a huge number of accounts is at risk.
People tend to use the same account credentials for all
services provided by one company so SecondLife game accounts
may be affected, too.

Description
-----------
1. xstreesl.com drops out of https in various situations. For
example the email created during in-game registration contains
an http-url. An other example is the redirect to http
immediately after login. If the Link "My Account" | "Edit Profile"
is invoked without https, the form will be transmitted in clear
text, too. This form contains among other things an input field
labeled "This E-mail will not be public but is required, will
be used to send your password if you lost it" and the
possibility to set a new password.

2. On login the following cookie are set: _utma,_utmb, __utmc,
__utmz, PHPSESSID, user. The are not flagged as secure, so they
are transmitted on http-requests as well. As mentioned above
the attacker does not need to lure the user on an
http://xstreetsl.com because the web application redirects
to the unencrypted http address itself.

Once the cookies have been sniffed the attack can use them to
do all tasks on behalf of the user. As prove of concept you can
use the Firefox extension "Edit Cookies" and add the sniffed
cookies manually to get access to the victim session. A real
attacker would of course use some script to automatically carry
out some actions (like steeling money by buying over
priced products).

Counter measurements
--------------------

1. The provider must ensure that the form at
http://xstreetsl.com/modules.php?name=Your_Account&op=edituser
always transmits the input over SSL.

2. The provider must ensure that the session and user cookies are
flagged as secure. xstreetsl should never drop out of SSL after
a) the user went to https://xstreetsl.com manually or b) while
logged in. This includes using https urls in the email
generated by the in-game registration objects.

Workaround
----------
(Note: Since provider finally addressed this issue after 41 days,
this section only provides historical information)

1. If you created your xstreetsl account before 2009-02-17 and did
not change your password afterward, do it now. If you have used
a password before 2009-02-17 at xstreetsl that you are using
somewhere else, change that, too.

1.+2. Don't use an email address as "private email address" that


you want to keep private. Keep your money at minimum and
only for the minimum time required.

History
-------
2009-01-21 Contacted provider about issue 1 using its JIRA
2009-01-21 Employee of provider replied that he has forwarded the issue
2009-01-22 Vulnerability 1 seems to have been fixed at least in some cases
2009-01-22 Provider contacted about vulnerability 2
2009-01-27 Provider contacted again asking for an update
2009-02-02 Provider contacted again asking for an update
2009-02-09 Provider informed about planned date of public disclosure unless some activity or schedule is visible
2009-02-11 Additional attempts to contact employees related to this area in
game to draw some attention to this issue
2009-02-13 Provider promissed to fixed the issues
2009-02-17 Poked provider again for schedule
2009-02-17 Provider replied that issue 1 has been adressed
2009-03-03 Provider replied that issue 2 has been fixed, too.

*** Provider did not inform customers as of now. ***


Note: As I contacted the provider using my game account, I have to
post this advisory without my real name, too. (If you wonder why,
have a look at my in-game-profile).

http://jira.secondlife.com/browse/SEC-267

But LL have already told us the proposed system won't work, when they proposed the Aristotle verification system. Now they've decided that won't work either. Can we get a consistent message please?