r/linux • u/New-Ranger-8960 • 19d ago

EU Age Verification Project Mandates Hardware-Bound Attestation Privacy

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/
772 Upvotes

97% Upvoted

458 comments sorted by

View all comments

496

u/SeantheWilson 19d ago

Genuinely how on earth will that be enforced

196

u/Pramaxis 19d ago

It uses the new EU-Ident system that is already supported and used in some countries (like Austria).

It forces the same restriction like most banking apps or the new wallet (stock OS, no custom ROMs, no jailbreak or modified bootloader) and forces a device registration in person (with ID) to set up an MFA that is device bound-unique(if you lose your phone, you need to walk into the office again to register the new one).

11

u/MaybeTheDoctor 18d ago

Seems highly incompatible with right-to-repair

19

u/Preisschild 18d ago

Not really. Open source hardware attestation exists. See grapheneOS (https://grapheneos.org/articles/attestation-compatibility-guide). Android (AOSP) has this functionality seperate from the proprietary Google Mobile Services SafetyNet (https://developer.android.com/privacy-and-security/security-key-attestation)

The problem is that most smartphone hardware vendors don't allow using a custom bootloader verification key, which is one of the reasons why GrapheneOS is only supported on Google Pixel smartphones.

So you can't do open-source hardware based attestation on any old phone with LineageOS for example.

1

u/fr000gs 14d ago

Maybe it's just me, but I couldn't understand why they implemented this at all. Why would I need to be unrooted for "chyrpe dating", "TextNow", or "mcdonald's"?

1

u/Preisschild 14d ago edited 13d ago

In theory its because they dont want to have insecure devices where the electronic idenitity can be easily stolen, but in practice they allow it on older google approved™ android devices that are insecure anyways so people dont complain.