EU age verification app to ban any Android system not licensed by Google
reddit.com
reddit.com
The operating system was licensed by Google
The app was downloaded from the Play Store (thus requiring a Google account)
Device security checks have passed
The issue is being raised here: https://github.com/eu-digital-identity-wallet/av-app-android...
I would like to strongly urge to abandon this plan.
Requiring a dependency on American tech giants for age verification
further deepens the EU's dependency on America and the USA's
control over the internet.
Especially in the current political climate I hope I do not have
to explain how undesirable and dangerous that is.
There are a number of comments in that same thread that indicate a mandate to utilize Google services may run afoul of EU member nations' integrity and privacy laws.
There is some amusing irony in the EU relying on the US for furthering its own authoritarianism. It's unfortunate that freedom (in the classic rebellious, American sense) never became that popular in the EU, or for that matter, the UK.
IMHO, the push for age verification is just a stepping stone towards requiring a mandatory ID for all social media posts made from EU. Given the current trends against freedom of speech, it's not unreasonable to think that by the end of the decade any site, including HN, might need to link usernames with their respective eIDs in case posts come from EU IP addresses.
> officially sanctioned hardware and software
Right now, if you want to run an alternative OS, it's already an uphill battle to use tons of member state services, as well as to do banking. Even if you have microG available, the situation is terrible. I imagine it's going to become harder. I cannot understand why the European Commission wants to reduce our reliance on FAANG services, and at the same time they make Google Play a de facto standard, reinforcing the mobile duopoly. In this context, free alternative mobile platforms, such as Sailfish, cannot flourish.
Hate to say it mate, UK is already one of the worst offenders.
In their own "internet bubble," with curated Google searches that only present a very "Commonwealth countries bias" in search results. After I worked in the UK for a couple of years, I noticed there is a strong bias toward the same sites (Government and UK companies, especially biased toward "facts"). Second, you leave the UK. You will never get it. Try a VPN outside of the UK and search for the same stuff, you will notice it right away.
The UK have used the "think about the children" excuse for different stuff they don't like (Remember the Porn pass Idea? Where you had to go down to your local Tesco to get a "wanker pass" from the cashier.)
Same thing, now just for EU, and they use the "protect the children" excuse, but they have now started to aim at video game companies and others to "verify" age for the sake of "protecting the children". It is horrifying that they want to ID children in the excuse of their "safety". In a couple of years, they will likely offer free in-game currency to trick users into giving away their personal information.
I think you're trying too hard to post cynical remarks as if the were this major gotcha. Even though the bill is quite awful, Occam's razor is quick to point out this has all the hallmarks of an overzealous technocrat than authoritarianism. Try to think about it for a second:
- the goal of the legislation is to ensure adult content is not provided or actively pushed to children,
- adult content is pushed primarily by tech platforms,
- the strategy is to allow access to adult content only to users who prove they are adults,
- the strategy followed is to push an age verification system.
- technocrats know age verification systems can be circumvented if tampered with.
- technocrats proceed to add provisions that mitigate the risk of tampering age verification systems.
The detail you're glancing over is US's hegemony over social media and tech platforms. The world is dominated by three platforms: Microsoft's, Apple's, Google's. Even Samsung is not European. How do you expect to push a technical solution for an authorization platform without leveraging the systems that people use?
Also, the way the current US administration is pushing their blend of fascism onto the world is something I do not find funny. If anything, this would mean the American fascists are succeeding.
I don't know how it works technically, but clearly there's a way to fake it.
Well payed "transatlantic" lobbyists across all political parties of the EU at work.
They are self-serving and learnt to give a big F* about the citizens of the EU.
But slowly slowly it will turn into mass terror and deaths. The control freaks in power are taking our freedoms away inch by inch.
The problem is relay services that supply positive age verification results to any interested user for a fee. With a non-privacy-preserving solution, those aren't a problem, law enforcement can just track whose credentials those services are using and shut them down.
I'm not a fan of the whole idea in general, but if we have to choose, I choose privacy over hackability.
Whoops, Google have delisted your government app from the Play Store, how quickly can you de-couple your citizens internet access from the corptocracy?
Then we have systems like:
PICS https://en.wikipedia.org/wiki/Platform_for_Internet_Content_...
POWDER https://en.wikipedia.org/wiki/Protocol_for_Web_Description_R...
ASACP/RTA https://en.wikipedia.org/wiki/Association_of_Sites_Advocatin...
Proving we do not need a system prone to PII leaks, just collaboration between content providers and guardians, helped by OS & browser vendors.
But it seems restricting minors is a side effect, at best, of the on going theatre.
No. The lesson is that stuff like this is concerning what ever the "political climate".
Anyway, you mainly don't want the gov in your vicinity to snoop. Non-local OS:es is probably advantageous in that regard if you choose to run proprietary code...
We say this, but many also want to entrust all our PC games to one closed source launcher. Or have videos/TV all on one subscription service. There's definitely a spectrum of benevolent and greedy dictators people draw lines on.
I think that is far more that people like the other closed source launchers less, and each launcher potentially adds it's own stream of notifications and adverts to their system so there is a cost to having multiple active even if the PC resource cost is practically undetectable.
Furthermore if comparing game launches and related issues to political climates, I'd consider all the current closed source ones to be the same in those respects. Also we are not subject to several local political climates at any one time in that way (though we are when looking at a wider scale, of course).
> Or have videos/TV all on one subscription service
While there are other issues (each service tracking you etc.) this is more due to the fact that each service charges what we used to pay (in fact more, as in some cases prices have gone up by more than general inflation) for a single service that provided the same amount of content that they cared about. This doesn't really equate to trust on political climates (except where commercial greed is considered a political matter).
And obviously it is not just one arena, because it seems to be one glaring issue with human beings: they do not want to see the road ahead. And the ones they do are, at best, ignored.
Steam makes the most money if it bridges interests of consumers and publishers together - they don't profit by screwing over the customer(either publishers or end users). Is depending on them a problem? yes, but least likely one. preferably you could move your digital licenses to any provider you want.
Meanwhile subscription services profit the most from enshittification, especially ones that offer 'free' access with ads, or different tiers.
and this current issue isn't even about dependence on google - that's bad in itself - but about gigantic governmental overreach and step towards killing anonymity online under guise of protecting the children.
It is even worse when you consider some EU countries already went after people when politicians got insulted online.
https://commission.europa.eu/strategy-and-policy/priorities-...
this is not the way to make a point that the other party will find persuasive.
https://www.pewresearch.org/global/2025/06/11/confidence-in-...
whatever your political alignment, saying the situation in the US is problematic might sell pretty well in the EU.
In this case, however, it's your poor English to blame. In English when you talk to another person, that other person can be called the other party. It's not an attitude, it's a very neutral term.
But it's nice so many people care about the last few places where hard freedoms exist. The biggest risk is missing the forest for the trees and not seeing the local extensions of short term political comprise.
I am forever thankful that Trump won the last election. If it were a Democrat party at the helm it would be practically impossible to have opposition to this, as most of the left would simply fall in line and cancel anyone daring to oppose the party. Look at how Obama strengthened the Patriot Act and carried out mass deportations with but a tiny grumble from the press.
Protecting Kids from Social Media Act (Tennessee HB 1891)
Sponsors Representative William Lamberth (R‑TN)
Requires: Social media platforms to verify users’ ages and obtain parental consent for under‑18 users; restricts retention of verification data; allows parental monitoring & time limits. Went into effect January 1, 2025.
Utah Social Media Regulation Act (SB 152 & HB 311)
Sponsors: Sen. Michael McKell (R) , Rep. Jordan Teuscher (R-District 44)
Requires: Mandatory age verification for all users; parental consent and oversight for under‑18s; bans algorithmic targeting to minors; curfews; data‑privacy protections. (As of mid‑2025, enforcement blocked by litigation.)
The Walker Montgomery Protecting Children Online Act (Mississippi HB 1126)
Sponsors: Walker Montgomery (R‑MS)
Requires: Digital service platforms to verify age using "commercially reasonable" methods, obtain parental consent for users under 18, limit collection/use of minor’s data, moderate harmful content (self‑harm, grooming, etc.)
Texas SCOPE Act (HB 18, “Securing Children Online Through Parental Empowerment”)
Sponsors: Bryan Hughes (R-District 5)
Requires: Platforms to verify the parent/guardian age if the account is for a minor; parental consent before collecting data for users under 18; content filtering for self‑harm, etc. Enforcement partially blocked by lawsuit.
Kids Online Safety & Privacy Act (S. 2073 – pending)
Sponsors: Sen. Jon Ossoff (D-GA)
Requires: Commission study into age‑verification technologies; does not mandate verification itself
Utah Social Media Regulation Act S.B. 152
Sponsors: Sen. Todd Weiler (R)
Requires: Mandatory age verification, parental consent, time‑bed restrictions, limits on algorithmic recommendations; currently blocked in court
Mississippi Walker Montgomery Protecting Children Online Act (HB 1126)
Sponsors: Representative Walker Montgomery (R‑MS)
Requires: Age verification for digital services, parental consent, limits on data collection and harmful content moderation
Georgia Protecting Georgia’s Children on Social Media Act (SB 351 / Act 463)
Sponsors: State Senator Brandon Beach (R)
Requires: Platforms verify age of new users; under‑16 require parental consent; schools to ban social media access
Virginia Amendment to VA Consumer Data Protection Act (SB 854)
Sponsors: Sen. Schuyler VanValkenburg (D) , Sen. Lashrecse Aird (D)
Requires: Requires age determination, parental consent for under‑16, limits usage to 1 hour/day unless overridden by parent, fines up to $7,500 per violation
Louisiana HB 142 (and HB 570) Online Age Verification for Adult Content
Sponsors: Representative Laurie Schlegel (R)
Requires: Websites where ≥ 33% of content is adult must verify users are 18+ via IDs or transaction data; private causes of action allowed
Ohio HB 96 (2025 law)
Sponsors: Bryan Stewart (R-Ashville)
Requires: Criminal penalties for commercial sites failing to verify adult content users
Iowa SF 207 / HF 864
Sponsors: Kevin Alons (R-Disctrict 7)
Texas SB 2420 (App-Store Age Verification)
Sponsors: Angela Paxton (R)
South Carolina HB 3405
Sponsors: Representative Brandon Guffey (R‑SC) prefiled Jan 2025
Proposed: Require app stores to verify age and obtain parental consent for minors; still pending
Protecting Kids on Social Media Act (S. 1291 federal bill)
Sponsored by: Senator Brian Schatz (D‑HI), Senators Tom Cotton (R‑AR), Chris Murphy (D‑CT), Katie Britt (R‑AL)
Requires: Social media platforms to verify user ages, prohibit access to under‑13s, block algorithmic feeds to users under 18, require parental consent for minors
App Store Accountability Act (H.R. 10364 / companion Senate bill)
Sponsored by: Rep. John James (R‑MI‑10); Senate version by Sen. Mike Lee (R‑UT) with Sen. Richard Blumenthal (D‑CT)
Requires: App store operators verify ages and obtain parental consent before minors download apps or make in‑app purchases; federal preemption and FTC enforcementMy thesis isn't that Democrats write those bills, my thesis is that there is never effective citizen resistance against government overreach when Democrats are in power. People can only be free when they are fighting the government and people only fight Republican governments, ergo we must vote Republican to keep the fight going. Both sides are our enemy, but one side enjoys a much larger cult following that will never attack it.
You're 100% right that it's happening today.
Do not think for a moment that ID verification primarily protects children and only incidentally enables authoritarian restrictions on speech. Do not think for a second that verification initiatives are designed without anticipating this outcome.
https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_wha...
Not commenting on ID checks but depending on the protest, some images can be violent and definitely "adult".
I never understood why we go out of our way to "protect" children against seeing naked people, but real people in a pool of blood, nah, no problem. I think that people bloodily fighting each other for causes that I have a hard time understanding even as an adult may not be what we want children to be exposed to without control. Images of violence create a visceral reaction and I don't think it is how we should approach political problems, in the same way that porn may not be the best approach to sex, the same argument for why we don't let children access porn applies to political violence too.
The point I wanted to make is that whatever your opinion is on ID checks to access to adult content, "adult" doesn't and shouldn't just mean "porn".
The average person could never do that; critical evaluation was always needed (and it was needed for the material people encountered before the internet, too.) The only thing that is a change from the status quo ante in the first sentence is “LLM generated”.
The west is going to be less and less free.
I'm sorry I feel the chill writing this, but I hope the hackers keep the flame alive.
Hackers: keep giving the finger to regulators when they overreach. They don't get to make the future.
Political problems cannot be solved through technology or yet another forked FOSS project. They require political power, numbers and threat of violence to those in charge.
The population (especially the youth) is anesthetized by social media, shorts, fear-inducing news, economic hopelessness, climate extremes..
In the meantime, everything is getting integrated - banks, tax systems, tech platforms. Now this age verification.. And of course, AI is being implemented everywhere so that no one can evade the big brother.
As it stands now, this Internet is no longer salvageable imo.
If anything, I’m seeing more calls for internet regulation on HN and other tech places than in the past.
Every time something is shared about topics like kids spending too much time on phones or LLMs producing incorrect output, the comments attract a lot of demands for government regulation as the solution. Regulation is viewed as the way to push back on technological and social problems.
The closer regulations come to reality, the less popular they are. Regulation seems most attractive in the abstract, before people have to consider the unintended consequences.
The most common example I can think of is age verification: Every thread about smartphone addiction come with calls for strict age-based regulation all over the place.
Yet the calls for strict age-based internet regulation generally fail to realize that you can’t only do age verifications on kids and you can’t do it anonymously. The only way to do age verification is to verify everyone, and the only way to verify that the age verification matches the user is to remove the possibility of anonymity.
The calls for regulation always imagine it happening to other people and other companies. Few people demanding internet age verification for things like social media seem to realize that it would also apply to sites like HN. Nobody likes the idea of having to prove your identity for an age check to sign up for HN, they just want to imagine Facebook users going through that trouble because they don’t use Facebook and therefore it’s not a problem.
Let's stop beating around the bush. We all know this doesn't make any sense.
The "temporary anomaly" is one of perception. It was individuals talking to individuals. In terms of volume the world has never had this much free flow of information, and its never been easier to transmit encrypted data within a group.
At the same time the problem with letting the internet be without government means it pushes digital crack to all children, and an oligarchy of (natural) monopolies tightly control certain powers through systems like "sign in with Google".
The options for companies to instead use a government backed digital identity seems like an obvious step forward if designed carefully enough.
That requires the right mindfullness of people's rights, eg the right story. I just don't think the war on the free-internet narrative from 30 years ago is up for it.
They want to stop children from accessing porn, which really isn't all that bad. Certainly it's not nearly as bad as wasting hours on perfectly legal social media and streaming sites
They flip flop on this stuff at least once a month, and the most annoying part is that they always herald everything they do as some new epoch-defining initiative only to quietly forget about it and do the opposite a few months later.
If nation states are dogs, then EU is the chihuahua: loud, proud and extremely ineffective.
Better check on that.
There was an article in the New York Times last week about how many E.U. countries have actually gone back to border checks. Most recently, Germany and Poland.
The European commission, the top of the EU's unelected and mostly unchecked bureaucracy, is currently suing its data protection office after it declared that its use of Microsoft 365 infringes data protection laws.
I mean, the EU wants to force browsers to recognize its own web certificates, while allowing Google to selectively deactivate your phone's capacity to conduct ID checks. It's the same with the "EU Cloud initiative", that at the end was full of non-EU companies.
The aim of the EU bureaucracy is not sovereignty, but extension of its power, nowadays called as "regulation". And when in place, it can't be removed, even if it's clearly self-harming.
The EU is not a hegemonic state, but rather an economic supranational organization. France/Germany tend to be primary proponents of increased EU strategic autonomy, while Poland/Czech/Baltic states are less supportive.
Similar to recent discussions of self-hosting, it's a tradeoff of autonomy/control vs efficiency.
> The EU is not a hegemonic state, but rather an economic supranational organization. France/Germany tend to be primary proponents of increased EU strategic autonomy, while Poland/Czech/Baltic states are less supportive.
Well obviously, these states know how bad the Russians are since they were terrorised by them for decades. They'll be the first on the chopping block. And they know that Europe does not have much deterrent of its own right now so they're screwed without the US. Though this will come.
Germany isn't doing this as much anymore, because Germany Inc has become increasingly dependent on their investments within the US [0], especially after the triple whammy of the Biden-era IRA [1], the sanctions on Russia sparking a domestic energy crisis [2], and Chinese players outcompeting German industry in China [3].
This can be seen with Germany purchasing American weapons for Ukraine over French objections [4]
[0] - https://flow.db.com/more/macro-and-markets/us-german-trade-r...
[1] - https://www.bloomberg.com/news/articles/2022-12-14/german-go...
[2] - https://oec.world/en/blog/bavarias-dependency-on-russian-gas...
[3] - https://www.reuters.com/business/majority-german-firms-feel-...
[4] - https://www.politico.eu/article/europe-donald-trump-weapons-...
Because in the background it's a French vs German vs Irish vs Czech vs $insert_eu_state business interests competing with each other.
Notice how it's almost always French legislators and businesses that mention "domestic EU tech" and not Polish, Czech, Romanian, Dutch, or even German policymakers or businesses?
That's why.
National interests always end up trumping the EU in it's current form. And for a large portion of the EU, American BigTech represents the majority of FDI (tech and overall).
Japanese and Korean automotive players did the same thing with the US in the 1980s-90s in order to ensure their interests remained aligned (though the Plaza Accords did play a role)
https://www.youtube.com/watch?v=Px9qhDGv300&t=150s.
(the entire video is interesting and informative, I've skipped it to the France-US specific part, up to about 11:02 where Australia is introduced as the US sycophant it is)
Whether it's logical or not, offences past, even those thought forgotten, are easily recalled when under similar pressures.
On the other hand, the EU bodies as well as national reps are besieged by lobbyists and diplomats, and without much backlash from constituents, it's very hard not to find someone that will do what you want. Just look at this former EC commissioner [1] working for Uber.
Flip-floping happens occasionally when the public catches up.
[1]: https://www.ombudsman.europa.eu/en/opening-summary/en/181717
I mean.. great for the politicians, not for an average european.
So until recently the "free" Internet did not matter politically in the EU. Tech was used to trigger color revolutions abroad where the demographics were younger.
But now the unelected EU commission inherited that Internet things and are on the wrong side of it. Worst almost everybody in the EU speaks English and listen to Joe Rogan & co. And while the US Gov might be able to control the Joe Rogan type the EU does not.
So their only move is to crack down on the Internet and limit it with a Chinese firewall type system. But they obviously do not have the ability to do so without the capabilities of an US tech giant (remember their own systems are on Office 365, every phone is Android or Apple). And this would also be in the interest of the US because it would give them a solid control over the EU.
Remember the first goal of a system is to survive and I do not see another realistic path.
Is this meant as a joke? It's not even remotely plausible.
https://ageverification.dev/Technical%20Specification/media/...
Essentially, the core user journey is a privacy preserving "over 18" check. I suppose this prevents under 18's from accessing porn, in the same way that most blocking technologies impose an expense on everyone but fail to block tech-savvy children.
Doesn't seem like it could ever stop someone with a bittorrent client, unless you have to attest you are over 18 to even use bittorrent.
So no, this is totally ineffective. And it's not like there's actually a problem. There's no crisis of messed up kids or young adults. We all had access to porn in some form and we all turned out fine. I used to watch the late night pay tv which was just 'scrambled' by removing the sync signal. It was easy to put that back with some electronics chops. I saw my share of gangbangs and cumshots and I did not get messed up or get weird ideas. In fact I often get compliments I'm a sensitive and caring lover. I never do or push for the dirty porn tropes (unless she asks for them :)
So did most of my school friends. Also video tapes got passed on at school and later CDroms (when the writable DVD came I was already an adult). We all had plenty.
This is all to mitigate a "crisis" which doesn't actually exist.
But I agree, forcing verification will not be effective enough, kids will find their way. The real solution is more education on this topic from younger age.
As girls grow up and become women, they become disinterested in men, due to the perceived danger. When boys grow up they become avoidant men who are scared of approaching and asking out women, due to the perceived risk of ridicule, shaming and legal action. This prevents the formation of stable marriages, which then culminates in low birth rates.
This is objectively not true. Not to say that a porn ban combined with age restrictions would help, but it's just objectively not true.
* Rise of incels as a thing, and even violence committed by them
* Various loneliness epidemics
* Rise of movements such as the 4B in South Korea, where women flat out refuse traditional relationships with men
* the rises in STDs and teen pregnancies can probably be explained by other factors
* The rises in various diagnosis (ADHD, etc) and rates of sexual assault can probably be explained by just having more rigorous reporting and testing, as well as higher awareness, but the rise of specific types of sexual abuse (like a popular one, choking without consent, which can easily lead to brain damage) can be directly linked to its prevalence in porn
* significant differences in opinion on equality and general political leanings between boys and girls
That's not to say that porn is a problem, and removing it for <18 will magically make everything fine. But things are decidedly messed up for a lot of teens and young adults, and parts of that messed upness can be potentially inspired by porn, and "the manosphere". The second one is more important IMO.
If I were a kid, I could see myself downloading Opera GX and enabling the free VPN. It's probably not "tech-savvy" because the browser gets a lot of ad views on YouTube; it would be pretty obvious.
Basically anything other than going to a legally compliant website and trying to attach your mom's passport to the age verification app and doing the challenge.
I think I have become far too cynical.
But this still wouldn't stop determined kids from VPNing to another country to make their account, and wouldn't stop peer pressure on kids from bleeding to parents to help them.
For instance, it's not illegal for me to be served alcohol. If I'm not carded when being sold a drink, nothing illegal has taken place.
If the lawmakers are being cowards and not saying they want to round up and ID all the children from birth until they are eligible to participate in the adult world, that's their battle to fight and not our burden.
Don’t know how to describe how insane this is
You can not check the age without breaking the privacy, technically it is Not possible; this is like a religious faith exercise, not science.
What one read in the specification is, firstly you install an official software in your device, the device becomes identified "as you" the first time you verify your ID and receive your unique internet ID hash, linked to your personal data at the identifier platform.
In addition, your unique internet ID hash will become you, and each time a Non-porn-related platform ask for it, you will leave track of who are you -as internet ID- to the platform (finger printing), and also what you visit to the identifier platform.
Yeah, I said Non-porn-related platform, literally, because what we are reading here is about an Internet digital ID hash for each EU citizen,
Lets be clear, if it were to protect the children from porn, it would say "verify with the personal internet ID only for porn sites", in company with all the adjectives derived from porn, exclusively, with specificity, nothing more.
But what we are seeing here about this matter is deliberately open to interpretation, they say "platform that can be considered to be accessible to minors"... boom, What does this mean, News for adults? Criticise a corrupt government for adults? In my village this is called a back door trojan, because when they want they redact the directives, laws, with precision.
Anyway, I invite the reader to take a look to the Digital ID directive on its own,
https://eur-lex.europa.eu/eli/reg/2024/1183/ (2024)
https://eur-lex.europa.eu/eli/reg/2022/2065/ (2022)
After this, they only have to define progressively, frog cooking time, and increase the affected Internet platforms with obligatory identification, and then we will think that the Great Chinese Firewall was a children game compared with this.
The "it's to protect the children" political tactic to break privacy is quite old. In addition we should remember the other EU law about breaking the encryptions.
My humble opinion.
PS: Ironically no more of two months ago I was saying that as I was European I have freedom and I didn't need a tooling for circumvent something like the Russian and Chinese censure. Oh my... If I were know this, I was absolutely blind about what someones try to cook.
Because the practical reality here is, like, porn is the big scary word, but the actual danger to kids is *other people.* Other addictions still exist. Removing one vice without solving the underlying systemic problem merely shifts the goalposts, and everyone is up in arms about what a slippery slope that is for good reason.
EDIT: Clarity here because I phrased that badly in a hurry: I'm in disfavor of internet access being a requirement for schoolwork, but I failed to set that context initially. If parents trust their kids enough with access, once they've reached a certain point of maturity, that's fine. I'm against technological age gates and I'm against removal of bad content from the net at large. Parents should decide when their kids are ready, and guide them appropriately.
I will leave my original remarks unedited so the remaining discussion is sensible. (Sorry!)
W T F ? ? ?
> Because the practical reality here is, like, porn is the big scary word, but the actual danger to kids is other people.
Bad news, Champ. Other people also exist off of the Internet. They always have. The world is not entirely safe. And that does not mean children shouldn't get to be part of the world.
The main problem here is panicky idiocy.
That idea has never really been realistic short of keeping them isolated from society until 16-18 (which most would consider abuse), but it’s not even slightly possible today with how readily available information has become. It’s an inevitability that they will learn about the topics you’ve been avoiding and take on external influences you may not approve of.
Now to be clear, I’m not advocating for letting kids run wild on the internet with no guardrails, especially earlier on. Guardrails are important, but it’s even more important in my opinion to try to stay ahead of what they may encounter by talking with them about those things so when they eventually run across it, they’re not flying blind and might even seek your guidance about the incident since they know you’re not going to get angry about it. That’s much more likely to bring positive outcomes than if they ran into these things without parental support.
As for other people being the danger, there’s some truth to that for women. I have a daughter, so this will be a concern. But you know, she won’t die. Everyone goes through trauma. The key here is to make sure she feels comfortable enough to talk to me and to my wife before doing anything (too) stupid.
I snuck out of my parents’ house to go see a girl when I was 16. Took my dad’s station wagon. On the way, some car tried to pass me and ended up hitting a big truck on the side. Truck was fine, I was fine, that fella was not. He ended up on the side of the road. Me and trucker just kept going. I still think about that guy a lot, because obviously the correct thing to do would have been to call 911, but I was a dumb 16yo who was out past midnight to go see a girl.
Point is, if things went a little differently, I could have been the one who crashed, or even dead. But that doesn’t mean that the girl I was going to go see was somehow a threat to me. It means I was doing something dangerous.
Again, this is easy to say as a man. The threat model for women is different. But prohibiting minors from the internet without supervision is totally absurd, and I feel bad for any parent who helicopters their kids like that.
Ultimately your kid will grow up and have their own life. Do you want to be remembered as the parent who had them under lock and key in the name of safety, or as a parent who monitored from a distance and occasionally let them do stupid things so that they could learn from it? For me, the latter is far more preferable.
We don't need the governments to mass surveil us to protect us. We need them to sort the economy and stop invading countries and being deferential to corporate interests instead of the people they represent.
It's such an obvious push that If you don't want to see it, it makes me think you're shielding yourself to avoid contending with the reality: These politicians and govs all around, including the countries you claim "work" are absolutely power hungry and beholden to interests other than yours and will push for as much total surveillance as they can, including as much curtailment of freedoms as they can.
Obviously that won't mean elites will actually face justice or crimes will actually be solved because more surveillance is not accompanied with more government transparency, quite the opposite and bigger and more powerful burocracies, with more authoritarianism, allow for easy hidden exceptions that you can't question.
It's nothing new. Corruption is common. It's just mediocre to see "hackers" pushing for it just because the government and corporations tell them to, because foreign country bad, bad social media influences kids, drugs, word-ism, etc.
You say “so many people are advocating for this in HN” but this thread was empty except for one other comment (which was also critical of this) at the time you posted your comment.
HN and even the GitHub comments mostly start with the assumption that of course we should do this. Of course we should restrict social media to under 16/18s and either are in favor of ID to access the Internet or pretend it won't happen by consequence of this.
Now try to address what I said instead of poorly calling me out.
The internet used to be a bastion of freedom. That era ended around 2005.
Age verification is already a thing IRL, there is no reason to not extend it online considering so much of our lives is digital. Overall I think anonymity should be reduced on the internet in general - a big reason of the world issues, especially in USA is that ideas can grow in forums where people under etherial identities can tell lie after lie without any repercussion.
See, I wouldn't have as much of an issue if you were honest about this real intention, because of how on the nose it is to reasonable people.
The idea that I will have to upload 3D models of my face and ID, or get permission from Google, just to go online because you don't like the idea of someone else's kids using the internet is absurd.
Please stop using appeals to children in your quest to "stop ideas from growing".
In the same way that you have a stable IRL identity that is your actual body so when you go into public places, you can be identified later if need be.
Ah yes. Anonymity is the only thing that enables dishonesty and of course it's the government's moral duty to regulate it.
Once anonymity is banned, the world will be honest and good and True and we'll all look back on the Bad times thinking how silly we all were.
The best part of minority report was the way everything constantly tracked identity through retinal scans; i can't wait for the future!
It's a shame you don't read the North Korean press. Otherwise you'd know that the elimination of anonymity on the Internet led to exactly this
It's a privacy preserving over 18 check.
Is it a "slope"? Sure, you can imagine an extension to the system that is "worse".
Is it "slippery"? This thing isn't draconian enough to be effective. It will be a minor speedbump that prevents exactly zero determined under-18's from accessing anything that they'd want to. So then the question is, does the government react by trying something more draconian, or does it give up?
[1] https://grapheneos.org/articles/attestation-compatibility-gu...
After a lot of angry emails towards the helpdesk, they at least changed it, so a failed check only shows a warning that you can accept.
Seriously. You don’t need Google. You just need a plan and a will to execute.
My guess on what happened this time is, people were tasked to implement a way to verify age anonymously and this was the only feasible way to do it because of their constraints that don't allow them to do bigger stuff that China or USA will able to do through having the budget and enforcement power.
I know politics isn’t logical but if you keep drilling down the root cause, eventually you’ll hit bedrock.
We have EU regulations, those are much tighter than in US, on practically every front. Labor, finance, environment, data, AI, you name it, we have it regulated. And then you have the country level regulations on top. That's right, EU sets the floor, not the ceiling.
Suppose you have a start up in Poland, you have managed to get funding and you are offering services in your country. You want to do that in Germany? Get ready for complying with new set of regulations. And you better hope that individual German states don't have something extra on top of those.
All of those regulations have purpose, it is possible that they were designed by well meaning people and bring some benefit. But their compound effect is catastrophic. It is not that you can't push trough, you can, just look at Kiwi or Mikrotik. But it's an uphill battle and your competition from overseas has it so much easier, that they can end up outgrowing you, and eventually buying you out.
Everyone’s ready. The only reason US is wealthy is those subscription fees and vendor lock in we have.
Anyway, if a government tried to make a European smartphone design, it would be treated as any other government supply contract, resulting in a terrible design-by-committee. So in the end, all politicians are willing to do is wait around and say "someone should do something".
It's actually a little better than that. One thing they can do, and have done, is make funds available for individuals and small groups who want to have a go themselves. Notably NLnet funds a lot of projects. They're all small projects though so they're not really capable of displacing megacorps in the free market. Stuff like MNT hardware remains niche hacker stuff.
Google rolls into town and wants to spend half a billion euro on a datacenter? Sure thing. They'll say that it'll boost the local economy while being built - by creating a couple of thousand jobs for the contractors that are going to build and maintain it, and then some onsite jobs for the next decade or two, creating a couple of hundred jobs for techs / engineers.
And as long as they keep playing ball with google, projects like that will pop up once in a while. If you're difficult, there's also a risk of the rich tech companies taking their business some other place.
With that said, I've recently noticed more voices for building our own stuff - as there's a real risk that US tech companies will simply comply if pushed enough, say, by a POTUS that's out for blood and wants to hurt certain foreign users. Ban/lock out certain users from gaining access to software, turn off their infrastructure, etc. who knows.
But, alas, there just isn't the same willingness to pour in capital on the important things. For private investors it doesn't make much sense, unless they have a bulletproof contract with domestic users willing buy their service - and using state funds isn't too popular, either.
Truth be told, any of the big tech businesses can undercut any competition, and probably build better and faster. If anything, it could be the case for tariffs - outsourcing critical infrastructure will leave you very exposed. If European countries all over the board started to abandon US tech companies, they'd cry to Trump, who in turn would probably start a trade-war.
You are right to be worried. US companies under this administration can’t be trusted to follow the law. Why should they, when our commander in chief isn’t and has a panel of judges who let him do whatever. Just the other day he suggested Obama be investigated for treason. So yeah, we’re toxic, and you all should seriously quarantine yourselves.
You also can't just say, "Here's a few hundred billion in public support to create alternatives to U.S. tech giants", because the U.S. would argue that it's unfair state aid and retaliate.
There isn't enough private capital in the EU with the risk tolerance required to take on such a challenge independently.
We also lack a reserve currency like the USD, so we can't print $2 trillion a year, much of which ultimately flows into the U.S. stock market and further boosts U.S. tech companies, making competition even harder.
EU markets are already fully penetrated by U.S. behemoths that can either withstand or acquire any privately funded competitor, thanks to their massive cash flows and valuations.
For all these reasons, the outlook isn't very promising.
That can be improved by making traditional investments (real estate, land) less attractive while making investments into businesses more attractive. You just need to change tax incentives by removing capital gain tax and introducing real estate/land value tax (or raising it). Removing red tape would help as well and then making the common market really common.
As it is there is very little incentive to invest in companies here.
American companies like Google [0][1], Amazon [2][7], and Microsoft [3][4][5][6] have spent billions in FDI and hiring, thus building strong relationships with EU states like Ireland, Romania, Poland, Finland, Sweden, and others, but French and German competitors haven't (or don't exist depending on the service or SLA).
This means a significant portion of EU member states have an incentive to maintain the relationship, because the alternative means significant capital outflows. A Polish legislator doesn't have to answer to French voters, so they will incentivize the relationship with BigTech. Thus, these nations will lobby tooth and nail against destroying the relationship.
It's the same reason Hungary courts Chinese FDI [8] and enhancing the Sino-Chinese relationship as leverage against the EU pushing too hard [9].
[0] - https://www.gov.pl/web/primeminister/google-invests-billions...
[1] - https://www.gov.ie/ga/an-roinn-fiontar-turas%C3%B3ireachta-a...
[2] - https://www.aboutamazon.eu/news/job-creation-and-investment/...
[3] - https://centraleuropeantimes.com/microsoft-google-invest-big...
[4] - https://www.reuters.com/technology/nordics-efficient-energy-...
[5] - https://www.idaireland.com/latest-news/press-release/an-taoi...
[6] - https://www.government.se/articles/2024/06/prime-minister-to...
[7] - https://aws.amazon.com/blogs/industries/cloud-technology-emp...
[8] - https://hungarytoday.hu/hungary-seeks-to-stay-leading-europe...
[9] - https://theloop.ecpr.eu/hungary-and-the-future-of-europe/
The post WWII doctrine of US that's applied in Europe is strengthening the bigger businesses. Those businesses use US tech since investing in an actual European tech sector is expensive. Especially after all the first players took critical positions.
The time to invest in that sector was in the 80s and 90s. Europe had a different relationship with the US and it was trying to encite small ex-Soviet states to join, so they can exploit the cheap labor. So nobody actually invested in local tech sector.
It is now an uphill battle that'll cost more than the original investment. Only countries with strong independence urge like France is willing to fight it. Most of the EU countries are not.
> and the one that was a bit better than terrible was bought by a US company
But here you say EU can make great software? Just that USA then buys it. So we should just ban USA from buying our great software companies, is that what you are saying?
Struggling to think of corporate produced software that doesn’t suck. iOS Safari is ok, I guess.
I can do most anything online, haven’t had to physically visit an gov office for years, outside voting and getting a new passport photo. And everything just works.
Edit: and before anyone points out that we’re not in EU, yes - but we’re in the EEA.
I use GrapheneOS as a daily driver and I absolutely love it. It should be the default. There's already one app I use that must do something similar and absolutely just won't run on it, so I have an entirely separate phone running stock Android just for that one app. Still worth the hassle.
Glad I don't live in a place where all this madness is taking root, but still, the trend itself sucks.
Furthermore, there's nothing stopping the governments implementing these standards from permitting GrapheneOS' signature. It's one of the ROMs that actually has a reliable signature so unlike random images from XDA there's a case for it to be permitted. Google's integrity check isn't just a binary check, it's a combination of a hash and a pre-defined list of suggested acceptable hashes.
So you complain to the service, they either ignore you or tell you to use the app, and then what? They are not breaking any law as far as I can tell.
And even if it was, class actions in Europe are close to inexistent, and it's not worth it for any one consumer to take the multinational running the service to court.
> there's nothing stopping the governments implementing these standards from permitting GrapheneOS' signature
incompetence and/or not caring
> Very well sir, which digital payment service would you like to use?
> It doesn't matter they all force me to use my phone.
https://grapheneos.org/articles/attestation-compatibility-gu...
EU wants to push more control on the internet, today it's "think of the children" but when the infrastructure is rolled out, it'll be "real name verifiction" on social media, chat control, etc.
Whoever is pushing this in EU has to be removed before things will get better.
A question I have is who voted for this? I sure didn't.
I don't.
The whole point of this is that they can't, which is unlike the systems they had used before. The only information that the service provider receives is that an age check has passed.
Kinda, yes.
(slightly simplifying the mechanism here)
This seems to be based on the EU Wallet project, which is still work in progress. The EU wallet is based on OpenID (oidc4vci, oidc4vp). The wallet allows for selective disclosure of attributes. These attributes are signed by a issuing party (i.e. the government of a EU country). That way a RP (relying party) can verify that the data in the claim (e.g. this user is 18+) is valid.
However, this alone is not enough, because it could be a copy of that data. You can just query a wallet for that attribute, store it and replay it to some other website. This is obviously not wanted.
So the wallet also has a mechanism to bind the credential to a specific device. When issuing a credential the wallet provides a public key plus a proof of possession of the associated private key (e.g. a signature over an issuer-provided nonce) to the issuer. The issuer then includes that public key in the signed part of the credential. When the RP verifies the credential it also asks the wallet to sign part of the response using the private key associated with that public key. This is supposed to prove that the credential was sent by the device it was issued to.
Now this is where the draconian device requirements come in: the wallet is supposed to securely store the private key associated with the credential. For example in a Secure Enclave on the device. The big flaw here is that none of this binding stuff works if you can somehow get access to the private key, e.g. on a rooted phone if the wallet doesn't use a secure enclave or with a modified wallet app that doesn't use a secure enclave to store the private key. You could ask a friend who is 18+ to request the credential, copy it to your phone and use that to log in.
Is the EU essentially foisting a someone-else-owns-your-keys regime onto their citizens?
Without the wallet, you'll be forced to jump through the same hoops as you're doing right now. Depending on what EU country you live in, that can be anything between "no real difference" to "making an appointment to exchange stamps on documents".
The idea is that once you get used to that, you will get censored from all the internet.
> Is the EU essentially foisting a someone-else-owns-your-keys regime onto their citizens?
Not quite, it's the EU essentially foisting a don't-use-free-software regime onto their citizens
Oh no! Imagine you find a willing adult who does the verification on your phone. The whole system is moot!
Don't need "copy" here for that. They can just do the verification on your device without any technical tricks
Yeah. that's where this system fails. It only stores a single attribute that you wouldn't mind putting on someone else's phone. In the full EU wallet the 'over 18' attribute is part of a larger set of credentials that is basically your entire digital ID. If you were to put that on someone else's phone they would be able to identify as you to numerous government and adjacent services. You'd be a fool to share that.
This whole scheme feels a bit rushed and not thought through.
Uh, replay attacks are a solved problem in pretty much any industry standard challenge-response authentication, including OpenID. Am I missing something?
It does seem like people tried very hard to make it privacy preserving.
Instead, they're trying to shoehorn your device into providing the same safety level and, in doing so, making it by design impossible for you to control your own device. Obviously if the sites trust a device that you control, you can make it tell them anything. The ideological part is that it's not your device anymore then and imo we should oppose that. The technical solution is to use the hardware security chip you already have with a reading mechanism that (nearly?) every smartphone already has and even works on any OS that can run a USB NFC reader. It could be an entirely open standard
Basically on such a system you can potentially manipulate the process. Here that would probably be to install the credentials of someone else on the device.
So they want a locked down OS environment where user does not have root privileges and software has to be verified (in this case by Google) to be installed.
None of this prohibits users from modifying their bootloader, kernel, or OS image; but any such modification would invalidate the secureboot signature and thus break attestation until the user registered their own signatures with the EU.
The EU currently only transacts with Google in this regard because, as far as I know, they are the only Android OS publisher (and perhaps the only Linux publisher?) that bothered to implement hardware-to-app attestation chaining live in production end-user devices in the decades since Secure Boot came onto the scene. All it takes to change that is an entity who has sufficient validity to convince them that outsourcing permitted-signature verification to Google is unethical, which it is.
It’s a safe bet that Steam Linux was already working on this in order to attest that the runtime environment is unmodified for VAC and other multiplayer-cheating prevention systems in games — and so once they publish all that, I expect we’ll find that they’ve petitioned their attested OS signature chain to the EU as satisfying age requirements for mature gaming.
The vendor lock-in here is that Apple and Google and, eventually, Valve, are both willing to put the weight of their business behind their claims to the EU that they do their best to protect the security of their environment from cheaters, with respect to the components required by the EU age verification app. The loophole one could drive a truck through that the EU has left open to break that lock-in in the future? Anyone can petition the EU to accept attestations from their own boot-kernel-OS chain signatures so long as they’re willing to accept the legal risks visited upon them if found to have knowingly permitted exploitation for age check bypasses, or neglected to respond in a timely and prudent manner when notified of such exploitability by researchers — and if the EU rejects their petition improperly, they’ll have to answer for that to their citizens.
But even if you were to want user's phones to be roots of trust...
> as far as I know, they are the only Android OS publisher (and perhaps the only Linux publisher?) that bothered to implement hardware-to-app attestation chaining
GrapheneOS does that. They guarantee this more than Google because Google allows devices with known vulnerabilities: https://grapheneos.social/@GrapheneOS/114864326550572663 (rest of the thread is worth reading, too)
Using Google Play's instead of Android's attestation framework means that nobody else ever could enter this market indeed, no matter how secure the OS
... unless they don't want to turn their device into a boat anchor that nothing else will talk to. It's not going to stop with age verification.
Counterproposal: fuck attestation, and fuck age verification. Individual users, not corporations, associations, or organizations, get to use any goddamned software they want any time they want for any purpose they want, and if you set up some system that can't deal with that, tough beans for you.
This is why it's important that initiatives like Web Environment Integrity fail. Once the tools are in place, they will always be leveraged by the State.
> and so once they publish all that, I expect we’ll find that they’ve petitioned their attested OS signature chain to the EU as satisfying age requirements for mature gaming.
I hope that Valve pays no mind to this nonsense and continues to allow art to be accessible to anyone.
Governments have real and serious need for verifications that are backed by their force. They’re a government; they are wielding force upon citizens by doing this, knowingly and intentionally. That is a normal and widespread purpose of the State existing at all: to compel people to align with the goals of the State, whether members of the State like it or not, until such time as the State’s goals are changed by whatever means it permits or by its collapse.
If this pans out for them, as cryptographically it will but remains to be how vendors and implementations handle it at scale, then they can introduce voting from your phone — the previously-unattainable holy grail of modern democracy — precisely because it lets the government forcibly stop the cheating that device-to-app/web attestation solves. And they can do so without leaking your identity to election officials if they care to! Just visit a government booth once in a while to have your identity signature renewed (and any prior signatures issued to your identity revoked). That’s how digital wallet passports and ID cards work already today anyways, with their photo/video/NFC processes.
Western sfbay-style tech was founded on the libertarian principle that one should be able to tell the government to fuck off and deny taxation, representation, blah blah etc. in favor of one’s armed enclave that does what it feels like. It’s fine to desire that, but it’s proven too radical to be compatible with the needs of nation-states or the needs they enforce satisfactions for on behalf of their citizens. Attacking attestation won’t solve the problem of the “State”, and has led us to a point where Google can claim truthfully to a “State” that the Android forks ecosystem isn’t competent enough to be trusted, because they can’t be bother to do attestations.
Who the hell wants this Internet...?
The under educated, unthinking unwashed masses. Just look at the tea leak. The amount of people that do not care about freedom or privacy on the internet vastly outnumber those that do. And because they do democracy unmasks itself in the digital realm as the tyranny of the unthinking majority.
Weep for the future.
ps: Had to add this post after the others identified the low class and the upper class as responsible for this ;). But depending on where you are, the low class might not be "the masses".
Scared rich people and bureaucrats
It really seems like tying this to Google violates some key principles of the EU market.
Who are the politicians making these decisions? How did they get elected? Did anyone vote for Totalitarianism 2.0?
And I'm getting tired of people pulling out pitchforks without reading anything. This is how democracies end up electing people like Trump. There are no regulations to require age verification here. The EU is simply giving guidelines for implementing harmonized age verification across the EU if any member states or companies that do business in the EU want to use it instead of making people scan ID cards like they currently do and making the receiver of said scans have to understand updates to the designs of the various ID cards used throughout the EU.
I don't recall any party campaigning on reducing internet freedoms.
Unless their governments start issuing Android devices to all of their citizens, I don't understand how they can require use of this app for anything official.
Not sure who you mean by "they" but you already cannot use a lot of governmental services unless you have an Android or iOS device (at least in Austria). At least in practice that is almost impossible.
> you already cannot use a lot of governmental services unless you have an Android or iOS device (at least in Austria).
That's terrible. They have official services that require an app and can't be used via a standard browser or even paper forms? What do elderly people without smartphones do?
Redacted, I wish...
To vote in the upcoming election, I was asked to upload an uncensored copy of an identity document to the website of the municipality of The Hague
To keep the domain I registered in 2014, the French TLD required me to send them the same thing by unencrypted email a few months ago. I tried sending a link to a PNG so it wouldn't linger in their inbox forever but they absolutely required it to be an attachment
To buy a prepaid card in Germany, I was required to show an uncensored identity document. I had put a tiny piece of tape tape over only the burgerservicenummer that the germans can't make use of anyway because it's the Dutch numbering system that's beholden only to specific authorities
There's scarcely anyone who appears to know what EU legislation says on identity numbers. The Dutch government themselves apparently don't
It turns out I was right. This is the intent. First require digital ID to access content/post anything on social media, then make it impossible to use said ID outside of the walled garden of Android and Apple, then tie this digital identity to your real world ID and make sure it can be revoked at anytime by the powers that be.
Bonus point, make sure everything you say or do is stored for unlimited access by law enforcement to protect the democracy(TM) or protect the children(TM).
If that is not a slippery slope, then I don't know what it is.
I also pointed out that creating a database of everyone in the EU containing a lot of PII in terms of religious preferences, sexual preferences and so on is a the stupidest idea that anyone could have considering that this tool could be used by the next parties in power to hunt down political/religious opponents.
Nobody can say that they did not know.
https://old.reddit.com/r/degoogle/comments/1mau7yl/eu_age_ve...
Who cares if it's Google or an American company. The point is you decided to let the E.U dictate what software you can run on your phone.
Who voted for this? Who asked for this?
This "think of the children" rhetoric targets encryption, anonimity, decentralized platforms, and private communication channels like messaging apps, VPNs, Tor, etc. It is nasty. Keep in mind that it does not actually prevent child exploitation and grooming. Most of the pedophiles are on Discord and Roblox anyways.
In any case, there are ways to prove someone is over 18 without revealing identity, but that is not that goal, is it? There are cryptographic schemes just for that, such as zk-SNARK, etc. ZKPs in general.
As much as the EU pretends there's some kind of united Europe, it covers different countries, with laws ranging from "sex work is just taxed work" to "all prostitution and porn is illegal". Even basic rights like gay marriage aren't consistent between member states.
Europeans were free to provide feedback to their representatives of course: https://ec.europa.eu/digital-building-blocks/sites/display/E...
However, everyone I've talked to about it said they don't care about it so they don't want to bother, which is probably what the people behind these laws are banking on.
I'm growing pretty tired of this rhetoric / rhetorical sleight of hand, but maybe this is a reasonable opportunity to discuss it:
- not all citizens of a jurisdiction are eligible for voting: in this case, cursory search suggests only 400M (88.8%) of 450M were eligible - seems a bit too high to me, but let's roll with it regardless
- not all who are eligible actually vote: voting in the EU parliamentary elections, which is what EU citizens can actually vote on, like most elsewhere, is not mandatory; it's a right, not a duty: turnout was 50.74%, and that is of the eligible population, so really just 45.1% (203M)
- most voting systems are mathematically unfair [0]: extensively researched, doesn't quite apply necessarily in this case though as per the next bit
- several key positions in the various bodies are elected indirectly: same here in the EU, at which point all bets are off
- laws, regulations, and policies are not voted for or against by citizens: same here in the EU too, nobody could have even possibly voted for this in the literal sense
It's a run of the mill representative system and I think it'd serve discussions a great deal if this was acknowledged properly. Surely it's agreeable at least that this wouldn't be such news if people were all just completely on board as the sentence "EU citizens voted for this." implies when read naively and literally.
I really don't see a point to this phrase other than inciting others. And before anyone brings it up, yes, this is common in US threads as well, yes, is often expressed by EU folks against US folks, but no, that does not make this better. Why dig ourselves into rhetorical holes unnecessarily? Being narratively justified to frame things this way doesn't mean one should (or must).
And "offering feedback" is not a vote nor a voting I'd say.
One thing I find reassuring is the nature of pushback on display on the repo (only read the first few comments there, mind you). Really not what I expected phrasing and rhetoric wise (unlike here), honestly kind of restored a very very tiny and fragile bit of faith in humanity in me, it's very reserved and reasonable stuff.
these people are monsters. don't help them, and don't be complicit. working on digital ID tech, and even disclosing vulns in it is like helping Hollerith make faster and more efficient punch cards.
If the proof can not be traced back to your identity, then what stops a person from creating large amounts of proofs and distributing them?
If the proof can be traced back to your identity, then... that would suck.
The reason you can't distribute a huge amount of proofs is that the app won't let you. To make sure the app won't let you, the app tries to verify that you're not running a modified app or a modified system environment. That's the remote attestation that "bans any android system not licensed by Google".
These tokens are signed and only usable for a limited amount of time so you can't just generate a million of them and sell them for others to use.
If the app can't rely on the system working as it should, it'll need to contain less privacy-friendly measures for limiting large scale token abuse.
For the proof to be traced back to your identity, you'd need to be tracked consistently across websites, possibly with the aid of the government itself. If ZKPs make it into the app, tracking you is basically impossible.
Of course, if you're authenticating with your full name and birth date, when opening a bank account for instance, you're not going to get the anonimity benefits. Still, you do get to see what party you've authenticated with and get a button in the app to request deletion or report suspicious behaviour if you think it was a scam.
Well, it's more like a framework, so not a ton of details. I've just glossed over it, but from what I can gather they have thought about it:
No personal data, especially no information from personal identification documents such as national ID card, is stored within an [Age Verification App Instance]. Only the Proof of Age attestation, specifically indicating "older than 18", is utilized for age verification purposes
Stored Verification(8b): [Relying Parties] may optionally store information derived from the Proof of Age attestation in the User's account, allowing the User to bypass repeated verification for future visits or purchases, streamlining the User experience. In this case, authentication methods such as WebAuthN should be utilised to ensure secure access while enabling the User to choose a pseudonym, preserving privacy. Risks in case of the device sharing should be considered.
[1]: https://ageverification.dev/Technical%20Specification/archit...
[2]: https://ageverification.dev/Technical%20Specification/annexe...
If a user can only make one then they'll have to use that identity with that service forever. That's a nightmare for privacy. Sometimes people need another account, unknown to their employer/family/friends. People should be able to make multiple accounts without those being tied together through a common "age check" identifier. But, of course, there is no way to prevent those from being distributed.
At some level I believe that's the purpose behind some of this. If someone can only have one proof, then someone can only have one account to speak with. They'll be easier to monitor, easier to identify, easier to silence. That's why I think these types of laws and behaviors should be resisted and protested.
I've mentioned in a previous comment that it's telling that big tech isn't resisting these totally-just-coincidental ID laws coming from western countries. It supercharges their surveillance and tracking abilities, and widens their moats.
Also, porn is a smokescreen. The definition of "adult" content will rapidly expand, and these put the ID issuers in censorious a position of control over people and services. Nothing stops a government attestation server from rejecting a request because someone is blacklisted from "mass communication services" because they're a felon, protestor, LGBT activist, etc... or because a service has fallen out of favor.
For all the shit Google deservedly gets they seem to be genuinely trying to implement good and privacy preserving solutions to a lot of these problems.
The issue of course is that there's essentially no way to do all this stuff with software and hardware the user actually controls themselves, so you end up with hard requirements that you use big tech as gatekeepers.
This is the slippery slope that IMO eventually ends the open web.
If you take that outcome as inevitable, which at this point I basically do given all the forces lined up to restrict access to information, I suppose Google is about the best steward you could hope for.
[0] https://blog.google/products/google-pay/google-wallet-age-id...
I don't and I wish Google et al would take a god damned stand against it. All it takes is 2 or 3 big companies to just not play along with the destruction of the open internet (the very same responsible for their genesis and incredible success), and the bureaucrats will eventually relent. Unfortunately they've chosen the path of least resistance, which also is the path of regulatory capture to their sole benefit. Sad to see that win over the ideals of the early net.
This has no effect, is it even used in production anywhere? It seems to be part of eIDAS which is a good thing, most countries already have their own identity systems as is stated in the README. The three or for id apps I have seen all have some kind of device check that is sent to the ID provider, it is not usually accisible for ServiceProviders though. On those apps you either get no indication or just a "seems suspicious" score.
The one in Sweden has a "return risk option". https://developers.bankid.com/api-references/auth--sign/auth
This does not make it possible to filter out people. And honestly considering the amount of shady phones people have I am not sure this will every work. Apple is sadly another issue, too many normals there.
It is nice that this is pointed out so we do not get a distopian future.
Bad deal all along.
My dad gets by in his "my dad" way of life without a mobile phone at all, I wonder how much longer this will be possible. I was about to rant about being forced to have a mobile if you want to participate in society, but then he uses a desktop for some of the services for which the rest of us use a mobile, so my rant falls down in that, for a while now, to participate in society you've needed either a computer or a mobile.
Hopefully computer-only can eke out some kind of base-adequate participation for a while longer.
From a legal point of view, the app should be a reliable convenience feature and not replace traditional (physical) identity verification. How much your dad will be affected will depend on how shitty and lazy the services he uses are. If he doesn't use a phone or a computer, he probably won't notice the difference.
Indeed, the bug links to another bug where the author says that it isn't restricted to Play Services remote attestation and recently followed up with a documentation update making that clear. https://github.com/eu-digital-identity-wallet/eudi-app-andro...
Unfortunate that it doesn't matter, because they're not going to accept anything that's not attested by some authority.
Attestation in itself is a bad thing, guaranteed to be horrifically abused in ways far, far worse than any problem it could possibly solve. You do not need to know what software I am running, period.
Your employer needs to know if your devices connected to its network have been rooted without your knowledge.
In any case, this is a completely different discussion from what OP alleged, which I hope we can all agree is completely false.
Adding to what I said earlier, this isn't even an app that any EU member state will use. It's just a PoC, as it says in the README. https://github.com/eu-digital-identity-wallet/av-app-android...
Unfortunately for the authors, the pitch forks are already out, and the mob is on the march. It's too bad that HN is contributing to it.
Seriously you can't make this stuff up.
It may be that the people in charge in the EU don't really care about the market dominance as long as they can collect enough extra money from them...
> The current release provides only basic functionality, with several key features to be introduced in future versions, including:
> - App and device verification based on Google Play Integrity API and Apple App Attestation
> - Additional issuance methods beyond the currently implemented eID based method.
> These planned features align with the requirements and methods described in the Age Verification Profile.
to the "In the case of Android, genuine means"...
I don't see the word "genuine" in the disclaimer. Is that a necessary part of using the "Google Play Integrity API" ?
(I'm genuinely asking, I feel like I'm missing some implicit context here.)
Also the EU: Well if you don't have a Google or Apple account you are not getting age verified.
How?, who?, Where? I'm afraid it is too late to find a group of people interested in creating a real network outside of the system. The best that i found was the LoRa communities but are useless for anyone submerged in the Tiktokian distopy.
Oh, so now we know who is pushing for age verification. FAANG
How sad is that, Europeans, you have fallen this low
The linked Reddit discussion is about the issue of attestation in the EU age verification application requiring a licensed version of Android to function properly.
The EU is not banning non licensed Android systems. This would make it hard for EU citizens to use those though, if they need that app.
It's just odd to see them bringing up America when their own government created this. Not the US. How about fight the actual problem instead of making sure the problem works on more devices.
Create a better, standardized, open-source parental control tool that is installed by default on all types of device that can connect to the web.
The internet aspect of the parental control should be a "Per Whitelist" system rather than Blacklisting. The parents should be the ones to decide which domains are Whitelisted for their kids, and government bodies could contribute with curated lists to help establish a base.
Yes, there would be some gray area sites like search engine image search, or social media sites like Twitter that can allow you to stumble into pornography, and that is why these devices that have the software turned ON, should send a token through the browser saying "Parental Control". It would be easier for websites to implement a blanket block of certain aspects of their site than expect them to implement whole ID checks systems and security to make sure that no leaks occur (look at the TEA app) like the UK is expecting everyone to do.
Also, I'm for teenagers (not little children) having access to pornography. I was once a teenager, every adult was, and we know that it's a natural thing to masturbate which includes the consumption of pornography for most in some way. Repressing their desires, their sexuality, and making this private aspect of their life difficult isn't the way. Yes, yes, there is nuance to it, (very hardcore/addiction/etc) but it should be up to the parents to decide with given tools if they trust their kid to consume such a thing.
As for the tool itself. Of course we have parental tools, but they can be pretty garbage, their all different, they're out of the way, and I understand that many people simply don't know how to operate them. That's why I believe that creating a standardized open-source project that multiple governments can directly contribute to and advertise for parents is the way, because at the end of the day, it should be up to the parents to decide these things, and for the government to facility that choice.
Obviously, besides the internet aspect, the tool should have all the bells and whistles that you'd expect from one, but that's not the topic.
EDIT: And yes, some children would find a way, just like they're doing now for the currently implemented ID checks. It's not lost of me that VPNs with free plans suddenly exploded in 4 digits % worth of downloads. A lot of those are tiny people who are smart enough. Or using an app like a game to trick Facial Recognition software.
Will people sign up to banks and betting apps with their eu wallet digital identity?
If it's not unbelievably obvious, there's an entire class of people flying private jets to "world summits" where the transcripts aren't disclosed. What do you think is going on? Use your brain.
That's easy for a company like Google to comply with. In fact the company I work for uses Google European data centers to comply with GDPR.
The wikipedia page does a pretty good job at explaining it: https://en.wikipedia.org/wiki/Trusted_Computing
Or rather is planning to. Right now it doesn't even have that integrity check, despite fully implementing the verification flow.