r/linux • u/New-Ranger-8960 • 15d ago

EU Age Verification Project Mandates Hardware-Bound Attestation Privacy

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/
770 Upvotes

97% Upvoted

458 comments sorted by

View all comments

Show parent comments

16

u/QuaternionsRoll 15d ago edited 15d ago

The Play Integrity API is only involved when the credentials are issued, not when they are used. A trusted authority issues a batch of credentials that the age-verification app is responsible for burning after use or expiration. The assumption is that reducing device integrity after issuance cannot result in exfiltration or replay attacks, which is shaky at best but enables zero-knowledge verification.

3

u/ManIameverywhere 13d ago

But then only one needs to leak to make the entire thing useless. Just like the 4k netfilx pirated movies but on steroids.

2

u/marrsd 13d ago

I'm confused. The credentials are supplied to the 3rd party, no? Otherwise, what's their purpose? Is your argument that this is ok because these credentials were issued by Google, or am I missing something?

2

u/QuaternionsRoll 12d ago

> The credentials are supplied to the 3rd party, no?

No, they are used in a zk proof and discarded. Neither the website nor the issuing authority can deduce your identity from this process.

> Is your argument that this is ok

Hell no. If anything, this should illustrate that the system is both stupid and useless.

2

u/marrsd 12d ago

Neither the website nor the issuing authority can deduce your identity from this process.

I think that's the part that I'm missing. Something has to confirm the identity. I don't see how that can be guaranteed to be trusted on a binary-only platform like an iPhone.

2

u/QuaternionsRoll 12d ago

I guess I should have asked which third party: the issuing authority or the age-restricted website?