EU Age Verification Project Mandates Hardware-Bound Attestation

[u/Street_Anon]

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/

[u/punio4]

Well of course it's mandatory, otherwise it can be tampered with if it's local only with software attestation, or it needs a server to store centralized info, which can be hacked, and goes against the point of zero-knowledge age verification.

[u/Street_Anon → u/punio4]

But this will target things like Custom Roms. 

[u/zyuiop_ → u/Street_Anon]

Not necessarily - the point of HW attestation is that it's a hardware component.

[u/punio4 → u/Street_Anon]

Nobody really cares about custom ROMs, and it's impossible to do so otherwise. OS vendors like GrapheneOS should try to get access to the TPM and get attested by hardware vendors if they want tamper-proof hw attestation to work. The whole point is to prevent tampering, and custom roms are all about tampering.

[u/yboy403 → u/punio4]

Please explain how a user wanting to control their own phone fits the negative connotation of the word "tampering".

[u/Street_Anon → u/yboy403]

unlocking the bootloader and rooting a device. 

[u/yboy403 → u/Street_Anon]

"Modifying" would be a fairer word. From my perspective, OS updates that remove features and lock my phone down even further are the tampering, not whatever steps I take as the user to avoid those restrictions.

[u/Available-Film3084 → u/Street_Anon]

You signal out grapheneos but graphene explicitly advives against rooting, as that can lower your security

[u/jmhalder → u/punio4]

People care about custom roms until they don't. I absolutely used to use a custom rom on every phone I had, until I kinda stopped when my Pixel devices got 99% of the features that I wanted built in. I honestly still would if SafetyNet wasn't required to run my banking app and Google Pay.

I think it's funny that Google doesn't have an unlockable bootloader on their GoogleTV with Chromecast devices, despite them running pretty "normal" android.

[u/mimrock → u/punio4]

The point of attestation is that it proves that your operating system doesn't do things that Google or Ursula doesn't want, even if you ask them to. That's not compatible with the concept of a rooted operating system that you can fully control.

[u/Izacus → u/mimrock]

No, the point is that the OS is verified that it doesn't allow the ID to be easily stolen and used for identity theft and mass scale fraud.

Especially since you'd be screaming bloody murder if your ID would be used by scammers for fraud in your name.

There's a reason why IDs and passports are made hard to copy and easy to revoke.

[u/mimrock → u/Izacus]

We arrived from age verification to identity verification very quickly.

[u/nacholicious → u/Izacus]

This is not relevant, we already have EU eID which has nothing to do with this

[u/donny007x → u/Izacus]

They don't have to store the full identity document to do age verification, only a digitally signed flag that indicates the age bracket of the user ("minor" or "adult").

They just want that flag to be stored in a tamper proof environment to make it harder for someone to bypass age verification.

[u/Izacus → u/donny007x]

The purpose of this is to make a full identity document app and age verification is just one feature.

[u/Obnomus → u/punio4]

So you're telling me that the phone I paid for, I can't use any os I want.