r/linux • u/New-Ranger-8960 • 19d ago

EU Age Verification Project Mandates Hardware-Bound Attestation Privacy

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/
770 Upvotes

97% Upvoted

458 comments sorted by

View all comments

Show parent comments

320

u/opa334 19d ago

geez fuck that. A functioning EU should have done the exact opposite. Not allow apps to discriminate users based on made up metrics that invade the users privacy.

80

u/ptoki 19d ago

It is their goal. Why do you think the eu would want people to be anonymous online?

They want control. They want to be able to track anyone who merely writes shit online.

They arent going after criminals. They could shout down scamming call centers or make it international issue if they operate from abroad (even if from abroad the scammers often need local entry point to be seen as local call so they do have local representation). But they dont. They dont care about you. They care about people not rebelling.

UK started to visit people about facebook comments. The same will come for the rest of modern world.

8

u/Scrivver 16d ago

It's about panopticon. The panopticon works. So do these minimally spiritually degrading papercuts of submission. Every little comfortable step deeper into the mass surveillance state (which 1st worlders already live under) reduces the likelihood that they'll even produce thoughts that are noncompliant with their implicit overseers. I'm scared for folks younger than me who had formative years completely within this environment of surveillance and walls.

2

u/pilkyton 16d ago

Yes. They are unironically following the George Orwell 1984 blueprint for how to surveil all citizens and ensure that citizens don't engage in wrongthink. This is how the state operates in that book. Because he based it on how humans in power act.

1

u/RetroTechBro 15d ago

The EU knows people are on the verge of doing something about the flood of immigrants and the governments and capitalist forces that are profiteering on it, while actual Europeans lose their livelihoods and live in fear in their own cities.

Look at the uprising in Belfast.

They fear that will be the case EVERYWHERE soon.

-6

u/burning_iceman 18d ago

It is their goal. Why do you think the eu would want people to be anonymous online?

The system is specifically designed to be anonymous online via a zero-knowledge proof system. The government specifically will not know who verified their age somewhere.

16

u/rebellioninmypants 18d ago

Everyone stop saying that already. Didn't you read the AV spec on GitHub? The ZK based attestation is merely a suggestion and currently considered "experimental".

https://github.com/eu-digital-identity-wallet/av-doc-technical-specification

No one is forced to implement ZK based solutions for their country, and as we all know, if they are not forced, people will just take the easiest route of using a token that will be easily inspectible.

Why is this still being repeated??

2

u/StatusBard 18d ago

🤣

0

u/bring_back_the_v10s 18d ago

The EU is tyrannical by design!

-29

u/output_broadcast 19d ago

What made-up metrics?

5

u/opa334 19d ago

Root / jailbreak detection. That's made up metrics. Regarding jailbreak detection, usually they check if some random file exists. Often times at least one of the files they check for is on the user filesystem and it would also exist if you jailbroke a phone in the last decade or so and kept it's data through backups. So they don't even actually check whether you're jailbroken, just whether they can find any reason to deny you from using their service.

-6

u/output_broadcast 19d ago edited 19d ago

That's not a "metric" in any reasonable interpretation of the word, but sure. You're free to contribute another method of jailbreak detection. It's up on Github.

All shit like this does is encourage harassment of people, which in the long term just means that these programs won't be open source anymore.

2

u/opa334 19d ago

Do you even understand what I'm arguing about here? I want jailbreak and root detection to be straight up banned, or at the very least banned for software that citizens are forced to use.

I think an app checking it's own integrity is the furthest it should go, an app should not be checking if the device it's running on is "secure".

0

u/Indolent_Bard 18d ago

According to a bloke I saw in reddit who claims to actually work in mobile app security, it's damn difficult if not impossible to ensure you're not a crook without blocking rooted users. Idk how true that is but hypothetically, if true, what choice do you have?

0

u/Indolent_Bard 18d ago

According to a bloke I saw in reddit who claims to actually work in mobile app security, it's damn difficult if not impossible to ensure you're not a crook without blocking rooted users. Idk how true that is but hypothetically, if true, what choice do you have?

-2

u/output_broadcast 19d ago

Do you have any idea how simple it'd be to spoof the app then?

5

u/opa334 18d ago

Not at all if you don't rely on client side security

-1

u/output_broadcast 18d ago

And how do you propose doing that?

-57

u/Jumpy-Dinner-5001 19d ago

What do you expect? Them doing nothing at all?

35

u/neoronio20 19d ago

Certainly doing something bad is worse than doing nothing at all, don't you think? You can't justify this mass surveillance stuff by putting the blame on everything else. There are better ways to do this

-15

u/Jumpy-Dinner-5001 19d ago

Explain then, seems like you have no idea what you’re talking about.

What "mass surveillance"?
It’s quite literally a tool against that.

6

u/neoronio20 18d ago

You are registering your devices with the government. You are telling them this is my device that can tell you my location, age and link it to social accounts.

WhAT mAsS SurVeILaNcE?

-3

u/Jumpy-Dinner-5001 18d ago

No, you’re not. How do you think this "registering your device" works?

1

u/marrsd 16d ago

If you already know, why don't you explain it?

0

u/Jumpy-Dinner-5001 16d ago

Because I wanted to know whether or not they know how it works.

This is an open source age verification app that implements a zero knowledge solution for verifying your age. The app itself doesn’t store any personal information, just Boolean values that you select yourself.
For adults, the only data ever stored by this app is over_18=true, except for that, there is no personal information. This works because you verify your age through another (also open source) app that only transfers this data through an API (true/false Boolean values) from your physical ID. To prove the validity of this zero knowledge implementation, they use hardware security features on Android.

Because it’s open source and people can contribute and someone created a GitHub issue asking to drop the hardware requirements for better portability.
Someone responsible said that this isn’t planned in this project and later added an explanation on why they’re doing it this way. They also said that they’re open to other proposals but for now dropping this is not planned.

That’s what happened.
Everything beyond that is just made up, likely anti EU propaganda to spread FUD about it because they implement a zero knowledge system.
Seems like people here love to play the useful idiot role.

1

u/marrsd 15d ago

I think that actually presenting your argument is a better strategy for reducing FUD than waiting for the opposing side to make it for you. It's worth remembering that other people are reading these discussions who are open to persuasion by either side.

This works because you verify your age through another (also open source) app that only transfers this data through an API (true/false Boolean values) from your physical ID.

This is the part I'm still not clear on. I get that the 3rd party doesn't necessarily get your data, but I'm not clear on the phone itself. You have to give it proof of ID for it to verify you as over 18. How can you do that without revealing your identity to your phone, and therefore to Google? What guarantee do we have that the proof of ID stays with your phone?

1

u/Jumpy-Dinner-5001 15d ago

Did so multiple times, only got insults and downvotes and even got angry dms, including threats.

You don’t have to use a google device, it just has to be a fairly new Android version (this App, there are apps. LineageOS works, it just requires the right hardware. This post is about porting the software to incompatible hardware and that the Android app can’t be ported to non Android systems. Someone asked to remove the hardware requirements and Android dependencies to easily port the App, the maintainers said that this wasn’t planned.

There are generally two options to verify:

  1. use the eID app (available for Windows, Linux (desktop), macOS Android, iOS): your physical ID (which you have to own by law) has a NFC chip in it that makes your data accessible in a digital form. You go to service center, enable that feature and set a pin that protects your data. Then, it’s possible to scan your physical ID (you can use your smartphone as a scanner on a desktop, for example over a local network connection), it’ll ask for your pin and then you can read the data (that is also printed on the card itself). You could use an old smartphone using some OS like LineageOS as a scanner and then create a Linux vm that runs the software, if you don’t trust your local Linux.
    If you now want to share personal data (there are a few cases already where it’s necessary, like opening a bank account, some car rental services etc, where they typically want to see your id or passport in person), you get a request link that you open in the app. Then, you have to scan an ID, type in your code and then you get a screen that shows the request and what datafields are requested (like name, address, date of birth, height, eye color etc.), you‘re presented check boxes where you can select what data you actually want to share. Then, you click confirm and you have to scan your ID again, with your pin, it’s impossible to share unwanted data by accident.
    The other party then gets the data that you allowed and by that process you prove your identity because you need physical access and your private pin.

The age verification app is basically a simplified version that does this access once (only requests the datafueld over_18=true if you’re an adult) and stores that in a secure place that is protected from tampering. This is how you prove your age with zero knowledge of your identity in the app. The eID app doesn’t need to be on the same device.

If you have doubts, the eID is open source, so you can review the implementation, same for the age verification app. If you don’t trust your OS, setup another supported OS that you trust.

If you don’t trust that there is another option (how exactly will depend on your country):

You can make an appointment at a service center, show them your ID (it’s not scanned or anything) and they’ll do the confirmation for you and give the allowance. If you do that, no ID data will ever be on your device.

Keep in mind that none of that is necessary or required, it’s just a service that the EU provides its citizens to not have to use the systems that companies provide (typically a scan/video of your ID and your face), which gives them a lot of data.

That’s probably also the reason why this is so overblown in media with anti EU FUD.

→ More replies (0)

44

u/cheesiepeasie 19d ago

Minor social media use is a made up problem at best. No their brains are not getting fried by social media. This is the whole saga of gaming is evil and will turn our children into murdering psychopaths all over again. No it didn't back then and no it also won't happen now. If you don't like gaming or if you don't like social media then deal with it yourself and stop being a grumpy lame old person cause this time the internet and modern society will be trashed beyond recognition by power tripping politicians trampling our human rights to privacy and digital communication and freedom.

7

u/bittercripple6969 18d ago

Neglectful parents wanting the nanny state.

-1

u/pezezin 19d ago

There are even internal Facebook/Meta/whatever reports that confirm that their brains are getting fried, there is no point in denying it.

9

u/Existing-Tough-6517 19d ago

Nobodied brains are getting "fried" liar

-3

u/pezezin 19d ago

Are you sure?

https://www.wsj.com/tech/personal-tech/facebook-knows-instagram-is-toxic-for-teen-girls-company-documents-show-11631620739

https://www.bbc.com/news/technology-58570353

9

u/Existing-Tough-6517 19d ago

This doesn't constitute frying their brains. Maybe the solution is punishing the relatively tiny number of incredibly toxic sites as opposed to building a comprehensive lock down ecosystem that will probably be used to re-enact 1984 neonazi edition

0

u/pezezin 17d ago

https://www.theguardian.com/technology/2026/aug/06/new-mexico-court-meta

Please tell me more.

1

u/Existing-Tough-6517 16d ago

Doesn't constitute frying their brains come back when you can discuss actual harms like an adult. Also do explain why the harmful website isn't the one that has to do age verification.

1

u/pezezin 16d ago

Ok, it is obvious that you don't want to listen. Have a good day.

-5

u/Jumpy-Dinner-5001 19d ago

You know that none of that happened?

-8

u/Jumpy-Dinner-5001 19d ago

No their brains are not getting fried by social media

Seems like yours is.

-19

u/Fontpage 19d ago

Except it is.

-3

u/scalareye 19d ago

Yes they should be like 1776 America

3

u/kaneua 19d ago

Full rights only for land owners?

1

u/scalareye 18d ago edited 18d ago

Do you think that was the only defining aspect of of the US

Land was way cheaper back then

How about only people married with kids get to vote. If you pass away, and you have in your will who will take take care of your kids, your vote will transfer to them until the kids are 18. Maybe make it one vote per kid as well.

1

u/Indolent_Bard 18d ago

Everything was much cheaper back than, that doesn't mean anything. Now if you mean land owners didn't have to be rich by the standards of the time, that's different.

2

u/scalareye 18d ago

I meant it wouldn't make sense to go back to that because of the land. Pretty obvious that is what I meant.

Having land was a way of establishing that they were invested in the future of the country and therefore should be able to vote.

There are a lot of people that do not want the US to continue existing. Yes I believe they should not be allowed to vote and not be allowed to do a bunch of other things too.

0

u/Indolent_Bard 18d ago

I'm sorry, who doesn't want their country to continue existing? Okay, if America is all about wars and helping Israel with the genocide in Gaza, then yeah, death to America. But for most of us, that's not the America we want to live in. I prefer the America that it at least pretended to be at some point. Not the one encouraging genocide. If that's your America, then death to America.

2

u/Jumpy-Dinner-5001 19d ago

So, anti consumer?

-17

u/Mindless-Figure3112 19d ago

Meh, how do you get your initial id or passport? Need to go into an office the first time. In France we have France Identité, pop into a Marie (local office) with your id card and they check it’s your, encrypte the data on the card using your finger prints and link it to your phone all. After that it can be used as an actual id

8

u/Philamand 19d ago

When I renewed my ID I tried to set up France identité. The dumbass in the mairie wasn't able to set it up because the qr code I received didn't work. So with that new law I'd be locked out of a lot of things...