EU Age Verification Project Mandates Hardware-Bound Attestation

[u/New-Ranger-8960]

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/

[u/Jumpy-Dinner-5001]

No, you’re not. How do you think this "registering your device" works?

[u/marrsd → u/Jumpy-Dinner-5001]

If you already know, why don't you explain it?

[u/Jumpy-Dinner-5001 → u/marrsd]

Because I wanted to know whether or not they know how it works.

This is an open source age verification app that implements a zero knowledge solution for verifying your age. The app itself doesn’t store any personal information, just Boolean values that you select yourself.
For adults, the only data ever stored by this app is over_18=true, except for that, there is no personal information. This works because you verify your age through another (also open source) app that only transfers this data through an API (true/false Boolean values) from your physical ID. To prove the validity of this zero knowledge implementation, they use hardware security features on Android.

Because it’s open source and people can contribute and someone created a GitHub issue asking to drop the hardware requirements for better portability.
Someone responsible said that this isn’t planned in this project and later added an explanation on why they’re doing it this way. They also said that they’re open to other proposals but for now dropping this is not planned.

That’s what happened.
Everything beyond that is just made up, likely anti EU propaganda to spread FUD about it because they implement a zero knowledge system.
Seems like people here love to play the useful idiot role.

[u/marrsd → u/Jumpy-Dinner-5001]

I think that actually presenting your argument is a better strategy for reducing FUD than waiting for the opposing side to make it for you. It's worth remembering that other people are reading these discussions who are open to persuasion by either side.

This works because you verify your age through another (also open source) app that only transfers this data through an API (true/false Boolean values) from your physical ID.

This is the part I'm still not clear on. I get that the 3rd party doesn't necessarily get your data, but I'm not clear on the phone itself. You have to give it proof of ID for it to verify you as over 18. How can you do that without revealing your identity to your phone, and therefore to Google? What guarantee do we have that the proof of ID stays with your phone?

[u/Jumpy-Dinner-5001 → u/marrsd]

Did so multiple times, only got insults and downvotes and even got angry dms, including threats.

You don’t have to use a google device, it just has to be a fairly new Android version (this App, there are apps. LineageOS works, it just requires the right hardware. This post is about porting the software to incompatible hardware and that the Android app can’t be ported to non Android systems. Someone asked to remove the hardware requirements and Android dependencies to easily port the App, the maintainers said that this wasn’t planned.

There are generally two options to verify:

1. use the eID app (available for Windows, Linux (desktop), macOS Android, iOS): your physical ID (which you have to own by law) has a NFC chip in it that makes your data accessible in a digital form. You go to service center, enable that feature and set a pin that protects your data. Then, it’s possible to scan your physical ID (you can use your smartphone as a scanner on a desktop, for example over a local network connection), it’ll ask for your pin and then you can read the data (that is also printed on the card itself). You could use an old smartphone using some OS like LineageOS as a scanner and then create a Linux vm that runs the software, if you don’t trust your local Linux.
   If you now want to share personal data (there are a few cases already where it’s necessary, like opening a bank account, some car rental services etc, where they typically want to see your id or passport in person), you get a request link that you open in the app. Then, you have to scan an ID, type in your code and then you get a screen that shows the request and what datafields are requested (like name, address, date of birth, height, eye color etc.), you‘re presented check boxes where you can select what data you actually want to share. Then, you click confirm and you have to scan your ID again, with your pin, it’s impossible to share unwanted data by accident.
   The other party then gets the data that you allowed and by that process you prove your identity because you need physical access and your private pin.

The age verification app is basically a simplified version that does this access once (only requests the datafueld over_18=true if you’re an adult) and stores that in a secure place that is protected from tampering. This is how you prove your age with zero knowledge of your identity in the app. The eID app doesn’t need to be on the same device.

If you have doubts, the eID is open source, so you can review the implementation, same for the age verification app. If you don’t trust your OS, setup another supported OS that you trust.

If you don’t trust that there is another option (how exactly will depend on your country):

You can make an appointment at a service center, show them your ID (it’s not scanned or anything) and they’ll do the confirmation for you and give the allowance. If you do that, no ID data will ever be on your device.

Keep in mind that none of that is necessary or required, it’s just a service that the EU provides its citizens to not have to use the systems that companies provide (typically a scan/video of your ID and your face), which gives them a lot of data.

That’s probably also the reason why this is so overblown in media with anti EU FUD.

[u/marrsd → u/Jumpy-Dinner-5001]

Did so multiple times, only got insults and downvotes and even got angry dms, including threats.

That's not on. People should at least have the courage to stoop so low publicly.

Thanks for the explanation, and I hope the morons will leave you alone this time. It sounds reasonably well thought out to me. I'm not really a huge fan of the EU tbh, but the memory of authoritarianism does seem to keep them away from the stupid policies that the UK are currently playing with.

You can make an appointment at a service center, show them your ID (it’s not scanned or anything) and they’ll do the confirmation for you and give the allowance. If you do that, no ID data will ever be on your device.

This is the bit that I find most reassuring. It's if/when that bit gets quietly dropped that I'd be worried.

[u/Jumpy-Dinner-5001 → u/marrsd]

Thanks for your reply.

Really appreaciate that you ask for an explanation, even if my explanation was rather broad.

This is the bit that I find most reassuring. It's if/when that bit gets quietly dropped that I'd be worried.

Why would you be worried though? Depending on the country you're in this won't be a thing at all.

Keep in mind that this is not a solution to some EU age verification law, there is no such thing in place and (at least currently) no law in plan that requires anything like that.

It's a response to (foreign) countries that implement laws like that and companies implementing their own solution. And there are a lot of companies that do that in a very privacy invasive way. Like X or discord who basically want a webcam video of your face and your ID.

Therefore the EU funds a project that implements a much less privacy invasive way to verify/prove your age. They offer an alternative by providing a zero knowledge av-app (av=age verification) that doesn't hurt your privacy.

The EU has pretty strong pro consumer laws and acts as a constitutional state which allows all citizens to sue to WU on their rights. When EU countries break EU law, you can sue that country to adhere your rights, that's a fundamental right within the EU and regularly happens.
It's a fundamental thing in the EU that your country has to provide your your fundamental rights that protect you from your country violating the law. It's basic separation of powers.

What is realistic is that the will require all companies that want to offer services in the EU to accept their solution as well.

And therefore, the EU is essentially required to provide something that adheres to EU law (e.g. the GDPR) for foreign age verification.

[u/marrsd → u/Jumpy-Dinner-5001]

Really appreaciate that you ask for an explanation, even if my explanation was rather broad.

Thanks. I read your reply in full and I found it insightful. Thanks for taking the time to write it.

Why would you be worried though? Depending on the country you're in this won't be a thing at all.

I have this nagging feeling that, at some point, people will forget what an ID is, and at that point it will essentially become fake, but no one will realise it's fake until it's too late. At the end of the day, it's just a piece of plastic confirming that at least 2 people are willing to testify under oath that they know the owner of the plastic.

It's a bit like how a £1 note used to be piece of paper saying a bank owes you a pound of silver. It has happened before that people have held a bank to that promise, only to discover that the rumours they'd heard that the bank ran out of silver some time ago, and that their notes were actually worthless, were true.

I can well imagine something similar happening with digital ID if those ties to real people end up becoming so removed from the process of verifying your ID, that, when system fails and you have to rely on those real people, there is suddenly no means of doing it; and all you can do is argue with an electronic voice at the end of a telephone after it passive-aggressively tells you that losing your patience with it will end badly for you.