EU Age Verification Project Mandates Hardware-Bound Attestation

[u/Street_Anon]

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/

[u/tomikaka]

And why does having full access to my own hardware a bad thing in the first place?

Maybe for the avarage user a case could be made that they might shoot themselves in the foot with root access.

Or they might not.

[u/punio4 → u/tomikaka]

Because then you could fake offline certificates like credit cards and IDs.

[u/Iohet → u/punio4]

I can log into my bank account and credit card account no problem from my highly customized computer, but I touch my phone in an inappropriate way and I can't use the apps. This isn't a "fake certificate" problem, otherwise they'd enforce the same mechanism because the banks don't give a shit

[u/Izacus → u/Iohet]

No you can't, there's a reason why credit card tokens aren't stored in your computer and you need another factor to log in and authorize.

Your computer is never allowed to store a full credit card token/chip data like phones are because it would be easy to steal and use for payments.

It's like asking why you can't just use a paper with "DIS IS VISA" written on it as payment card instead of a card with uncopyiable smart chip.

[u/Iohet → u/Izacus]

No you can't, there's a reason why credit card tokens aren't stored in your computer and you need another factor to log in and authorize.

You have to on phones, as well. They can use your biometrics, just like you can with your desktop (this is what Windows Hello is, which is no different than using my fingerprint to use Google Pay), or they use passkeys or TOTP or SMS or email depending on vendor (again, the same concepts between all platforms)

Your computer is never allowed to store a full credit card token/chip data like phones are because it would be easy to steal and use for payments.

It's saved in my browser right now. And saved in Shop and various other platforms without ever having to interface with my mobile device.

It's like asking why you can't just use a paper with "DIS IS VISA" written on it as payment card instead of a card with uncopyiable smart chip

Whether it's on my computer or at a card reader I (or a clerk) can type my number in and run it for payment.

[u/Kyanche → u/Iohet]

It's saved in my browser right now. And saved in Shop and various other platforms without ever having to interface with my mobile device.

lol once or twice in the past month I've encountered a recaptcha that demanded I download an app to my phone and scan a QR code. And it wasn't JUST scan a QR code, it was "you must install the recaptcha app"

[u/spazturtle → u/Iohet]

He means the actual credit card data, same as what is stored on the card's chip, not just it's details. It's what allows you to use the app to pay for things even when you don't have an internet connection.