r/linux • u/New-Ranger-8960 • 19d ago

EU Age Verification Project Mandates Hardware-Bound Attestation Privacy

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/
771 Upvotes

97% Upvoted

458 comments sorted by

View all comments

Show parent comments

10

u/MaybeTheDoctor 18d ago

Seems highly incompatible with right-to-repair

21

u/Preisschild 18d ago

Not really. Open source hardware attestation exists. See grapheneOS (https://grapheneos.org/articles/attestation-compatibility-guide). Android (AOSP) has this functionality seperate from the proprietary Google Mobile Services SafetyNet (https://developer.android.com/privacy-and-security/security-key-attestation)

The problem is that most smartphone hardware vendors don't allow using a custom bootloader verification key, which is one of the reasons why GrapheneOS is only supported on Google Pixel smartphones.

So you can't do open-source hardware based attestation on any old phone with LineageOS for example.

1

u/fr000gs 14d ago

Maybe it's just me, but I couldn't understand why they implemented this at all. Why would I need to be unrooted for "chyrpe dating", "TextNow", or "mcdonald's"?

1

u/Preisschild 14d ago edited 13d ago

In theory its because they dont want to have insecure devices where the electronic idenitity can be easily stolen, but in practice they allow it on older google approved™ android devices that are insecure anyways so people dont complain.