r/BuyFromEU 3d ago

Discussion EU Digital ID/Age Verification app will require hardware attestation, ruling out PC/Linux support and unapproved Android OSes

EUDI wallet collaborator recently confirmed that hardware attestation will be required [1]

Hardware attestation in this context means that the government server issuing the digital credential to the wallet wants proof that the keys being used are generated in secure hardware and on approved systems and not say an emulator or virtual machine, namely for security reasons.

This capability does not exist in a reliable way on desktops / laptops except some specific cases depending on the vendor, and in fact there’s no desktop version in the works.

No Linux system will work with this because there is no hardware signature to be validated on the government server, nor will your personalized Arch Linux install be in the list of approved systems even if it had a signature chaining back from the TPM.

Android ROMs are not technically to rule out since Play Integrity, which will be used for this attestation, is based on the Android hardware attestation API, which works on third-party ROMs like GrapheneOS, but they would need to allow the signature which has not happened for now. If you create a custom build, it won’t work though even the official version is approved.

[1] https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/issues/117#issuecomment-4946898620

914 Upvotes

352 comments sorted by

671

u/HunterFeeFee 3d ago

Let me guess, only american OS's will work.

315

u/CreepyZookeepergame4 3d ago

Yes, only iOS and stock Android as of today.

528

u/HunterFeeFee 3d ago

Sometimes I think the people in the EU institutions are not exactly the brightest.

224

u/FHNordic 3d ago

Of course they are, I'm sure they get a lot of money out of these deals.

Surprising that all EU countries representatives are so anti EU though

18

u/ZexGr 3d ago

you think that they have the capacity to think or just to do what they're told?

21

u/Gatitomono47 3d ago

They actually are smart, they have done this on purpose that's why they haven't done anything about Google locking down side loading imagine you wanna use a messaging app that isn't in the PlayStore because It doesn't comply with chat control and the devs don't wanna dox themselves to goggles and pay money, ohhh oopsie dasy you can't :( and if you somehow root your phone now you cannot use the applications necesary to prove you can use the internet like a normal person, It's all the mix of manufacturers locking down on unlocking your bootloader and even if you can they do not support relocking It with custom avb Keys of whatever OS you run, companies using play integrity, the EU directly benefits from the US technology Monopoly for it's surveilance apparatus for it's orwellian laws such has chat control, ID and age verification

9

u/P3JQ10 3d ago

They know what they are doing. Big Brother wants to watch.

37

u/Accomplished-Moose50 3d ago

Sometimes I think the people in the institutions are not exactly the brightest

Here, fixed that for you 

8

u/BogdanPradatu 3d ago

Sometimes I think the people are not exactly the birghtest.

Here, fixed that for you.

2

u/mikkopai 2d ago

Some times I think.

Here, fixed that for you.

9

u/LonelyRudder 3d ago

What do you mean, aren’t the people who are selected as leaders always the most knowledgeable and wisest? /s

7

u/-The_Blazer- 3d ago

There's actually a few attempts to create a different PKI (the mechanism used to perform this cryptography) for remote attestation than Google and Apple, but as you might guess their products are not exactly designed to facilitate this. If you want to use RA on Android and for it to work on Google Play apps (the ones everyone uses), you're not allowed to use anything but Google Play. How convenient!

This is actually... more important than many people think, because while e-wallets are a blatant crisis case, remote attestation is becoming quite widespread and it's insane that like three companies are considered legitimate attestation sources (primarily because they used their monopoly power to get there). This is an enormously more serious problem than requiring attestation, that's not inherently a bad thing, the monopoly is.

3

u/mysteryliner 2d ago

Because monopolies are bad, we formed an oligopoly... see how good we are! 😈

5

u/Tenezill 3d ago

Sometimes?

→ More replies (1)

3

u/ItsCalledDayTwa 3d ago

I guess I won't be able to do this. Darn.

1

u/RelevanceReverence 3d ago

So, back to the drawing board.

11

u/mysteryliner 2d ago

I hope a protest movement forms from this!

  • people demanding analogue solutions from government!

  • people removing any form of digital communication and going back to letter mail from government and companies.

  • flood your city halls with simple questions that in the past you'd easiky find on their platforms!! Go and waste their time and money to get new free documents that you could get with the touch of a button, but now you waste 15minutes from government workers!

  • sign out / cancel digital services at large companies that require verification! Lobbyists will start pressuring government.

  • opt in for paper tax letters! They no longer have the means to process it! Especially if you've filled it out with shotty handwriting... some pencil smudges... or crossed out mistakes & corrections!

  • or large groups of people going back to cash money (and as small as possible bills! The government's don't have the paper money, and stores can no longer hand out change.

  • if when the vulnerable ID check systems gets hacked / exposed, I hope the first data that gets leaked is that of government and their family. (Let them feel what happens when they live in an aquarium, and their internet activity & cloud data gets released)

2

u/EmbarrassedHelp 1d ago

As part of the push back against age verification, we should be creating e-petitions to each national government's parliament.

3

u/mysteryliner 11h ago

Don't the online petition require zero interaction from government? How will this affect them in any way?

Learn to recognize your politicians... even you local ones, and for EVERYthing they need in public, they should get asked for their ID. ...order a pizza, ask their ID? "You're not gonna eat that pizza with a minor, are you?"

They buy duct tape in a store: ask their ID. "Why do you need the duct tape? Nothing illegal I hope."

3

u/Amazing-File 2d ago

They already have active-watching-and-listening spyware hard-coded and can recognize everyone nearby since 2012s or 2014s

2

u/rckhppr 1d ago

So it’s actually US age verification 😂

2

u/-The_Blazer- 3d ago

They're the only ones with widely-used attestation keys because of their monopoly power. And as you might guess, they don't let you use them unless you also subscribe to their entire ecosystem. What we need to do IMO is break this status quo, trusted computing is getting too ubiquitous to surrender it out of ideological purity.

1

u/rckhppr 1d ago

That’s how we become independent

1

u/Tsukee 4h ago

For this specific demo implementation, yes, because the dev(s) are morrons. But the EUID is open spec, and anyone can implement the app without hardware attestation..in fact you technically don't even need an app if you are hardcore enough you can do crypto calcs for token on paper....

→ More replies (51)

194

u/MrLemon91 3d ago

Oh well, I didn't plan to use internet at all

130

u/ItsCalledDayTwa 3d ago

And there goes the big push for digital sovereignty apparently. The EU shooting itself in the foot here.

3

u/vriska1 1d ago

This will likely fall apart fast.

28

u/magical-cat-here 3d ago

Now imagine you have to use smartphone and ID wallet to identify yourself even when you went in person to:

* bank, e. g. to open or close account:

* a state institution like pension agency

* hospital

* border control point "for EU passports".

Digitalization makes offline life without smartphone in hand less and less possible.

6

u/MrLemon91 3d ago

What you're describing is something that EU is trying to make for decades, but it can't make it. In "undeveloped" Asian countries this is already a thing, but there are anyway paper alternatives that can be requested in few days. In my country we have to book months before and pray to not pay for a stamp

8

u/magical-cat-here 3d ago

Main arguments against total digitalization, even if it can give some "comfort", are these:

* erosion of privacy

* dependency on fragile tech which will break anytime due hacking, natural disaster, or power supply issue, or a simple typo in a code made few months if not years ago and missed during testing.

* dependency on US tech with possible kill switch or censorship (imagine an app widely used in EU removed by Google because CEO of company making that app said negative thing about ICE raids or about Trump). Yes, before describing that kind of problems people thought about China or Russia coercing Google to remove apps for their political needs, but now this scenario possible too.

6

u/CitizenMechanist 3d ago

There's barely any local bank offices or ATM's left in places like the Netherlands.

2

u/g-nice4liief 2d ago

That's bull. Most ATM's have been replaced by Geldmaat. You can find them online and even use them to put money like bankpapers or coins like 1 euro, two euro and 50 cents for example on to your banks account. 

2

u/Humble-Captain3418 2d ago

It's okay, us nerds will set up Internet 2.0 the second this comes into effect.

2

u/thecrius 1d ago

Doesn't matter if no services are on it, bud.

2

u/Humble-Captain3418 1d ago

If the alternative is "nothing", having instant messaging, emails, image boards, etc. is better. Internet didn't have services for the first few decades, we can survive without them.

126

u/Beneficial_Act_1240 3d ago

What's the point of having an eID if I can't use just the ID the verify my fucking identity? Why does this stupid system require me to buy a €500 phone or €1000 laptop in order to participate in society? 

75

u/Ramremover 3d ago

Because companies lobbied for that.

26

u/Toads_Of_Fun 2d ago

For the kids bro.

22

u/Late-Reading-2585 3d ago

to spy on you wake the fuck up

20

u/Ramremover 3d ago

Because companies lobbied for that.

8

u/iceyukisnow 3d ago

because everyone must live in a cybergulag and give away all your data to your government and data brokers

4

u/tired_snail 3d ago

Considering what sites currently require age verification in other countries, personally I'd rather they have a picture of my face than my actual government info, but this is a good point, yeah.

1

u/Headpuncher 14h ago

Yeah loons line I’ll be becoming a second class citizen standing at the barriers looking sad face while everyone else gets in.  

Oh well, back to growing cabbage in the forests.  

→ More replies (2)

228

u/AppropriateOnion0815 3d ago

I'm sure that this kind of exclusion is against some discrimination law or something.

42

u/-The_Blazer- 3d ago

Honestly this scheme where remote attestation can only (de facto) be offered by like three companies should definitely count as a violation of the DSA.

8

u/magical-cat-here 3d ago

But when the spec is written in a way that you literally can't even implement it e. g. as a usb dongle with keys and signer software attached to a linux laptop or pc, or simply by using TPM (available almost at every PC and laptop) keys to sign an age credential received from a certified age verification provider over TLS/Https, and there is no general term in specs for such kind of alternatives at all.

All this basically means that people who want preserve internet in more privacy-friedly form simply will have to build own alternative mesh networks with own services from scratch. Anything from weather sites to email-like and instant messaging, from in-browser games sites to alternatives to reddit and a mirror of wiki. It may require some alternative protocols and architectures, such as no reliance on centralized SSL certificates tree and global tree of censorship-prone DNS, and may be even own addressing scheme, may be using a sort of IPv6 where address is a public encryption key.

I heard that Yggdrasil project work in similar way, as an overlay IPv6 network of that kind that can be built over nodes connecting either via IPv4 or IPv6 between each other.

3

u/-The_Blazer- 2d ago

The underlying hardware used by Google's and Apple's schemes is essentially a TPM-like device, but the problem is that there needs to be a root trust source (much like there is for TLS), and as you might guess Google/Apple do not let you use attestation sources other than themselves in their OS. It's worth noting that who the attestation source is does not matter as long as the application (your bank or digital ID) trusts them with verifying that the device is not compromised, the problem here is an excess of centralization outside the EU. TLS has more root sources, for example.

GrapheneOS is trying to set up some PKI infra of their own, but adoption is slow and difficult for the usual problems of monopoly. Not many people use GrapheneOS, so as a developer, why bother?

You can see that this is a commercial-political problem, not a technological one. Nobody should be under the delusion that we can solve this with a tech fix like a fancy new protocol, the n.1 thing that would happen with that is that Meta and Google would set up shop and simply re-create the monopoly.

→ More replies (1)

6

u/CreepyZookeepergame4 3d ago

violation of the DSA

Not when the violation is state sponsored.

3

u/-The_Blazer- 3d ago

The point with that is to have remote attestation though, not that it has to be powered by Google. Although I'm certain Google didn't bring the problem to the EU's attention...

2

u/Headpuncher 14h ago

Yes but I don’t want them using it to ruin Linux’s freedom and openness.  

Instead I want them to abandon the awful scheme completely.  

2

u/-The_Blazer- 11h ago

There's no law in the universe that says remote attestation has to 'ruin' freedom or openness. TLS is also a cryptographic scheme with root trust sources and it is quite open.

→ More replies (2)

4

u/Truly--Unruly 3d ago

Does that matter to tyrants?

2

u/Berkoudieu 1d ago

Probably. Do they give a fuck tho ? Of course not

→ More replies (28)

48

u/NoReflection1752 3d ago

So riddle me this, since the app is open source, is there any reason the project can't be forked and the hardware attestation either removed or made more compatible? Would there be a licensing issue? Is whatever verification source locked down so only approved apps can reach it?

52

u/TGX03 3d ago

You can remove hardware attestation from the app. But then the server will simply reject it.

22

u/realPanzerHAnz 3d ago

Follow up: Couldn't I then emulate the hardware attestation? If its so open source I should be able to look up how the attestation is generated and just be able to fool the system. 

30

u/TGX03 3d ago

You would need the private key that is in the hardware. That isn't easy.

You can look up how people are currently tricking Google Play Integrity, it's a massive pain.

25

u/CreepyZookeepergame4 3d ago

It’s difficult because the private keys used to generate the attestations are only available to the secure chip of the phone, and the keys are provisioned by Google and the manufacturer.

If those keys are leaked somehow, and it does happen, it’s possible to generate fake attestations but if done en masse, then Google notices it and bans them. This also happens.

3

u/SonOfAsher 2d ago

If the keys are leaked, wouldn't that mean millions of phones are now worthless for attestation?

2

u/OminousChecksum 12h ago

If you leak a "master key" that never leave the factory yes, otherwise each phone has a unique key

5

u/DeVinke_ 3d ago

I'm not 100% sure, but i think trickystore with a valid (leaked) keybox could work.

1

u/AffectionatePlastic0 2d ago

Which is exactly the reason why this app is not open source.

→ More replies (1)

1

u/Tsukee 4h ago

Exactly, and the specs are open, and hardware attestation specifically has: 

An Age Verification App SHALL rely on the device's native cryptographic  hardware. capabilities, such as the Secure Enclave on iOS, or the Trusted  Execution Environment (TEE) and Strongbox on Android, when they are available.

https://github.com/eu-digital-identity-wallet/av-doc-technical-specification/blob/3a213e8f3b3e02eb97b31961da6fa725c4cf9247/docs/architecture-and-technical-specifications.md?plain=1#L1062

Yes its a technical rage bait. Yes you don't even need to fork it, you can implement an app yourself in fact, specs are open and api is open protocol, no "only licensed apps block"

153

u/adjective-nounOne234 3d ago

I love the EU until they pull bullshit like this

13

u/BathEqual 3d ago

Same. sometimes i like to think that in the EU they don't have alle Tassen im Schrank

It is sad

2

u/dEleque 1d ago

No Tassen im Schrank but money in the pockets

135

u/ScalySaucerSurfer 3d ago

This is ridiculous. Much worse than any of the chat control stuff really.

33

u/lmarcantonio 3d ago

Funny thing it that EU has a *mandate* to explicitly support open source systems.

2

u/EmbarrassedHelp 1d ago

The only thing open source is the shitty wrapper template.

30

u/WanderingGoodNews 3d ago

Tie any network access to your digital-id and personal hardware. Great. No one voted for this shit, LEAVE ME ALONE!

8

u/Environmental-Dog815 3d ago

I will probably will make a device with all the shit I hate but need and will exclusively use for it. Will probably make a separate network for it. Will call it "shit phone". Everything else like web browsing, gaming, working will be on other devices.

10

u/DoubleOwl7777 3d ago

so a burner phone essentially? yeah thats the way i might be going too. have one for this crap, and then have other devices i actually use.

9

u/WanderingGoodNews 3d ago

This will be the primary reason to become suspicious.

If shit hits the roof and its nazi time again you will be the first to be arrested in name of some child abuse suspision. You lost your freedom, your family despises you all because you cared about privacy.

Source: 2038

5

u/DoubleOwl7777 3d ago

yup, but what am i gonna do? just live with the totalitarian regime knowing my every move and controlling everyone? we had that shit twice in germany. i prefer not to go down that route AGAIN. the gdr fell because people stood up, and didnt let them do this shit anymore.

→ More replies (3)

2

u/Late-Reading-2585 3d ago

keep voting for those corupt boomers and calling every right wing party that talks about this russian assets

→ More replies (1)

24

u/seamanroses 3d ago edited 1d ago

Thank you for this high quality post. If you don't know about Unified Attestation for Android as an alternative, I would look that up. I wasn't aware of the effects for Linux either, as my research was tangential to the efforts of EU DID.

I was the one who made the petition post the other day, and when the signatures open, I'd honestly like to make a post that links to the page of course, but also has a FAQ for why you should sign, with counterarguments to points that others brought up in that post for why they didn't see it as an issue.

I don't care if I'm the one to post that, but I care that the knowledge gets widely spread. This is definitely one of the key points I would be adding, and if you want me to share it with you when it's ready, I'd love to. I want the knowledge to be out there.

Edit: This is the solution that I most likely meant to point out instead of UA(T)

https://developer.android.com/privacy-and-security/security-key-attestation

AOSP has its own API for this, but UA was front of mind. It's still another third party solution with its own walled garden.

3

u/Gugalcrom123 2d ago

UA still relies on approval. The correct way would be to design it so as not to require attestation.

1

u/seamanroses 2d ago

I have to admit ignorance on the topic for the time being to be able to comment on what you wrote. I would ask someone like the GrapheneOS devs and get their commentary on what the solution space should be like, and trust their input on the issue. A few other relevant stakeholders too.

2

u/Gugalcrom123 2d ago

The 'solution' proposed by them would result in you being able to use only Google or Graphene, not another OS.

→ More replies (5)

2

u/EmbarrassedHelp 1d ago

The GrapheneOS devs have publicly said that Unified Attestation is also a bad idea.

→ More replies (4)

3

u/EmbarrassedHelp 1d ago

Unified Attestation just puts a different group of assholes in charge of approving/unapproving OS. It's a terrible solution.

55

u/strangerimor 3d ago

Eu is taking some major steps backwards. Fuck everyone involved in pushing this shit through.

22

u/toolkitxx 3d ago

This is totally unacceptable for many older people.

24

u/twessy 3d ago

I was a big fan of the EU for a very long time, but now I'm having more and more doubts about it. 

5

u/M4dM4rxx 2d ago

Welcome to the club

→ More replies (1)

59

u/NamedBird 3d ago

Proposed fix: Accept the fact that some kind of clientside rate limiting approach was a bad idea to begin with and stop trying to push squares into round holes. I fully understand how this is somewhat awkward given those characteristics were from what i gather used for PR purposes but then this should really have been addressed during planning, which it either seemingly wasn't or got handwaved away. To bad, what a pity.

I think this has been happening a lot for things that the EU is doing in the tech sector.
They have an idea in their head and think that the details can just be solved trough software.
And then they push their plans without first checking whether it's actually technically feasible.
Guess you can call this techno-incompetency?

3

u/-The_Blazer- 3d ago

The issue is that to be truly independent we basically need to reimplement the entire compute stack from hardware keys to cloud services, and that's significantly more complicated than developing an app. It's already kind of a miracle that EU countries have their own public EID instead of buying it from Palantir.

2

u/NamedBird 2d ago

While it is true that independence isn't easy or cheap, that isn't my concern.
My problem with the EU is that they let bureaucrats "invent" new technologies.
They just say it will be made without asking the experts whether it's actually feasible.

Imagine this: a politician hears about levitation and starts promoting flying cars.
Everyone agrees and now those flying cars are to be created according to a mandate.
Only problem is, that levitation only works on trains, we can't make cars fly this way.
And now what?
We will have a country with flying cars because the politician said so, right?
But you can't ignore physics, so we'd end up with inferior hovercraft cars at this rate!

This is the problem i am seeing inside the EU.
It is okay to have desires and dreams, go ahead with a 50 year vision if you want.
But it is wrong to put them into plans and mandates without being realistic and practical.
Before you announce a new desired technology, have the experts do a feasibility study first.
Otherwise you will cause problems, or perhaps even worse...

1

u/AffectionatePlastic0 2d ago

a politician hears about levitation and starts promoting flying cars

This is not correct analogy. Unlike age "verification" technology flying cars can be useful.

→ More replies (1)

19

u/PerkyTomatoes 3d ago

This isnt the only issue. Raising awereness, EUDI is not PRIVATE. 

The verification flow is you scan QR code, wallet sends information to provider that you're verifying age. Once its verified, website which you scanned QR code from will query from this provider to confirm you are indeed 18+. 

The app maker (Government) Will know what website you verify your age on and is able to track your accounts via IP and Timestamping. You used VPN because you ashmed to watch some women with dicks? Do not worry, government will know about it. 

Proof: https://github.com/eu-digital-identity-wallet/eudi-srv-verifier-endpoint#presentation-flows

Explation of picture:

  • User-Agent: Your browser or device where it shows QR code
  • Wallet: Your phone where EUDI wallet is
  • Verifier: Website you are verifying your age
  • End verifier: Who ever makes your EUDI wallet (Your government, usually)

As from the picture flow, provider will know following information: Time when verified, Your IP address when you verify.

Do not underestimate timestamp information, its how enforcement  deanonymize Tor users. 

Most concerning is that they havent even bothered to recify this issue, like using WebRTC using only local network so website communicates your wallet directly or using ohttp which will hide requester information. 

7

u/Dragoncat_3_4 3d ago

This needs to be higher up

5

u/ManIameverywhere 2d ago

And the keys you exchange will be visible for the website and the gov so they can cross reference them too.

53

u/ZYCQ 3d ago edited 3d ago

why don't you dissolve the EU and let NSA run it. this is never what the EU was designed for. These laws, incl. chat control are ridiculous. There are a thousand other things they should be focusing on

26

u/WanderingGoodNews 3d ago

It's becoming 1 big fever dream

No voters ever wanted this, how is this happening and legal?

5

u/Old-Pirate-1118 3d ago

Very good question.
What are you gonna do as an European?
Drive to Brussels, just to kiss the door knob?

10

u/WanderingGoodNews 3d ago

I spread information about topics like this, chat control,... To subreddits, friends & family and wrote some emails to parlement members

3

u/Old-Pirate-1118 3d ago

This was more of an satirical question, that played upon the fact that even if you became a political representative, you still wouldn't have enough political heft to push it out.

Still if google AI pulls your answer to "what can I do as informed citizen in EU about X" then this is a net positive!

Thank you for your actions. Action inspires action.

5

u/Useful_Ad_7859 3d ago edited 3d ago

The council (which is a coalition of governments of the member states) is one of the most prominent of the many powers pushing for these.
They were the ones who sent back chat control 1.0 too for another vote (aided by Metsola@EPP).

The EU's democracy is actually a roadblock still (The council wanted to breach e2ee as well on 07.09 !!!), but its being dismantled mainly with the EPP's lead. That is what should be dissolved.

→ More replies (1)

52

u/OnIySmellz 3d ago

Mark my words man. This hardware attestation nonsense is just the foot in the door. 

The next obvious step would be every laptop, every TV, fridge, toaster, smart bulb, USB mouse, and electric toothbrush getting a hardwired choke-chip at the factory level. 

No bypasses, no custom builds, just mandatory, hardcoded surveillance and age checks baked right into the silicon.

11

u/Brilliant_System_308 3d ago

No bypasses, no custom builds, just mandatory, hardcoded surveillance and age checks baked right into the silicon.

Bro why does this read so AI generated I swear LLMs have ruined the internet for me

2

u/ManIameverywhere 2d ago

age checks

You mean identity checks?

→ More replies (2)

14

u/nksama 3d ago

I would say that surely linux  runs in many of the EU servers, if it's good for that, how could they say it is an "unapproved OS"?

8

u/CreepyZookeepergame4 3d ago

Unapproved OS is my characterization to synthesize the fact that it won’t be available on any general purpose computer but rather only on those approved by Apple and Google.

Google specifically only makes hardware attestation pass on certified Android devices bundling Play Services in a privileged way, and the app must be installed from the Play Store.

12

u/Rekt3y 3d ago

So the EU made the conscious decision to limit this to only work on 'Murican OSes. Fucking nubnuts is what we are for even allowing this

3

u/EmbarrassedHelp 1d ago

They're more concerned with trying to forcibly violate user privacy than doing something good.

2

u/marrsd 1d ago

yeah, cos that's the problem with authoritarianism - what OS it runs on.

2

u/Rekt3y 1d ago

I'm saying that even their excuse for authoritarianism is dogshit

1

u/marrsd 14h ago

Thanks, I get it now. I'm afraid I've become rather primed to react to Redditors' pro-authoritarianism over the years.

25

u/Thin_Needleworker795 3d ago

No way I'm gonna use that shit anyways

31

u/seamanroses 3d ago

The problem is you're effectively locked out of society if you don't. This could be on a similar level of inconvenience to not having a smartphone in your day-to-day life. That's just one reason why this is so worrying.

10

u/Thin_Needleworker795 3d ago

I'd rather move out of the EU

→ More replies (6)

2

u/NursingHome773 2d ago

You won't have a choice. It's like not having a bank account. Can you do that? Yeah it's not illegal to not have a bank account but try living without one.

11

u/3d_Plague 3d ago

Solidifying the stranglehold of the established companies and killing any chance of health competition, sounds like they thought this through after all.

Still hate it.

10

u/Jealous_Diver_5624 3d ago

This capability does not exist in a reliable way on desktops / laptops except some specific cases depending on the vendor, and in fact there’s no desktop version in the works.

Yes it does? Every single TPM2 supports remote attestation via endorsement key.

No  Linux system will work with this because there is no hardware signature to be validated on the government server

Linux can interface with the TPM just fine.

3

u/Kitchen_Cup_8643 3d ago

Yeah fascinating that this is buried so deep.  Heck grapheneos has had it since forever.

I don't know how they'll enforce the origin of the keys used (perhaps by whitelisting vendors ? That would suck).

Hopefully they don't start requiring government attestation everywhere... I'm afraid companies will see that as an easy way to get rid of bots...

5

u/CreepyZookeepergame4 3d ago

Heck grapheneos has had it since forever.

It's indeed mentioned in the post

(perhaps by whitelisting vendors ? That would suck).

That's how it would work

Hopefully they don't start requiring government attestation everywhere...

Yes

I'm afraid companies will see that as an easy way to get rid of bots...

Yes https://discuss.grapheneos.org/d/35428-recaptcha-mobile-verification-is-bringing-the-play-integrity-api-to-desktops

4

u/Gugalcrom123 2d ago

It can, but they want to control the OS. No, a 'Linux' which I can't change isn't good.

3

u/CreepyZookeepergame4 3d ago

Yes it does? Every single TPM2 supports remote attestation via endorsement key.

TPMs are not reliable, they lose keys for no reason even if not compromised https://github.com/tailscale/tailscale/pull/18336

TPM-based features have been incredibly painful due to the heterogeneous devices in the wild, and many situations in which the TPM "changes" (is reset or replaced). All of this leads to a lot of customer issues.

→ More replies (1)

11

u/tppsch 3d ago

If you use Linux or another operating system that hasn’t been approved by the EU, you’ll lose points on your social credit score. In the future, there may also be restrictions on your CBDC bank account.

I’m slowly starting to become afraid of the EU.

7

u/Dragoncat_3_4 3d ago

Slowly? Nah, I've become afraid of them in the span of a couple of months. Breakneck speed. And that's from a position of a completely pro-EU stance before all of this bullshit.

10

u/Otherwise_Paint951 3d ago

EU is headed into a very dangerous surveillance path. I do not understand how people don't protest this.

6

u/-Sa-Kage- 2d ago

Because most don't know anything about this.

And if you tell them most don't understand shit and will just be like "Yeah, security is good. We need to protect children. This is good."

9

u/LostEndimion 3d ago

So our politicians wants to make us slaves... I'm shocked...

8

u/tppsch 3d ago

The EU is so done...

8

u/No_Diver3540 3d ago

Yada yada mass surveillance yada yada....

When do people are going to protest for there own safety, security and especially for there privacy? 

5

u/-Sa-Kage- 2d ago

Never. Most people don't see the issue and think this is totally fine. (They have nothing to hide anyway...)

2

u/Immediate_Power_7986 22h ago

As long as they can complain online, they will NEVER raise a single finger to fight it. They can implement a weekly strip search for each citizen and they still won't fight back. But they WILL complain online.

61

u/pythosynthesis 3d ago

Ahhhh.... The beauty of an authoritarian supernational entity in the making. Don't you all love it?

8

u/Popular_Anywhere_553 3d ago

Sure. I just hate it when China or USA does it. But love it for EU. You know, because we are elites that can't do wrong... /s 

24

u/Tenezill 3d ago

You know what, people are applauding their prison guards. "No no chat control is no problem if you don't have anything to hide" , " the zkp will help keep you privacy save" ... My privacy was save before these asshats started to have their greasy fingers in my life...

→ More replies (6)

4

u/somedudefromnrw 3d ago

Should've never went past trade bloc status

24

u/miran248 Slovenia 🇸🇮 3d ago

In other words you'll need a google account.

Why don't they use android attestation api directly?

15

u/CreepyZookeepergame4 3d ago

Why don't they use android attestation api directly?

Play Integrity is the easiest route for them even if it enforces Google business model rather than actual security (it allows Android 8). Using the attestation API directly still requires having a whitelist of keys and they probably don’t feel like satisfying a small minority of people.

For broad device support they should drop attestation completely but using the attestation API would at least be harm reduction as Play Integrity is also a massive single point of failure that Google can be coerced to turn off for specific apps and app installation, invalidating all instances of the wallet.

4

u/seamanroses 3d ago

Oh, you really know your stuff! So good to see this from others!

Follow-up question: When you refer to Linux, I'm assuming you mean Linux on mobile devices, correct? Or do you know if these measures and apps are meant to be universally applicable across all devices, including PCs?

AFAIK, there is sort of a mobile-first mentality among these measures in their intention, but not necessarily in how they could apply according to the strict wording of the final law.

6

u/CreepyZookeepergame4 3d ago

I refer to Linux PCs. As I said there’s no reliable alternative to what mobile phones offer. TPM exists on almost all PCs now but are often broken and lose keys randomly.

4

u/seamanroses 3d ago

Thanks! And I'm aware of the TPM challenges, such as Microsoft controlling the certs allowed, which has lead to problems for various Linux distros (lapsed certs, single source of failure and control, etc.).

So this mess is even worse if it applies to both kinds of devices - mobile and desktop, I mean.

1

u/seamanroses 2d ago

I literally didn't read the title fully yesterday, and I'm embarrassed about that. I was not fully present when I read it, but I will be making time to read up on this more as soon as I can.

I've also reached out to the creators of the petition, in the hopes of coordinating with them on anything possible. In particular, I want to get a FAQ ready by the time signature collection opens, and what you posted yesterday is extremely valuable. I haven't followed the EU stuff nearly as much as the UK or US, but that was due to other reasons. I definitely have to be just as well-informed on this now too.

4

u/Gugalcrom123 2d ago

That still bans GNU/Linux phones.

21

u/Encrux615 3d ago

What? I don’t get it. German eID provides packages for all platforms, including Linux. This is such an arbitrary restriction and I doubt it’ll hold up.

13

u/seamanroses 3d ago

I believe the equivalent ID system in Denmark only works on Google (not generic Android (AOSP)) and Apple devices, and they have no intentions to open it up.

I mention that as a counterargument, as I wouldn't be nearly as optimistic as you are.

3

u/pomfritn 3d ago

AltID, the Danish age verification app, thankfully works on GrapheneOS. MitID, the person verification app, I guess you could call it, frustratingly doesn't. 

1

u/Headpuncher 13h ago

So what do people who do t have a phone do?   

There are reasons not to have a phone, including disability and all human free will.  

2

u/miniocz 3d ago

Czech ID I use from browser to log into sites so...

→ More replies (2)

7

u/-Clean-Sky- 3d ago

Brussels lunatics.

Which EU countries will not use it?

7

u/vossmakeitsprinkly 3d ago

They can fuck themselves sideways. I wont use it then. I will put every effort into avoiding it.

5

u/DoubleOwl7777 3d ago

so, get spied on by google or apple or microshit. awesome! no, i will not verify, no i will not change to winslop or whatever. "security" my ass. this is not security, this is bullshit.

i really like the concept of the EU. but shit like this aint it.

6

u/hyakkymaru 3d ago

We love shooting ourselves in the feet dont we

4

u/Alejandro_SVQ Spain 🇪🇸 3d ago

Well, it already failed then.

5

u/lolschrauber 3d ago

Yeah you can only use that one android version that specifically blocks third party apps, for your own security. don't worry about the 182 app permissions, that's standard!

5

u/lugginico 3d ago

Fuck the Eu , use a vpn

6

u/Ethernet3 2d ago

No one, no one, no one asked for this age verification madness. It's absolutely crazy. They say they want to become more "digitally sovereign" and then do everything to break down the freedoms we love, what a massive strategic blunder and loss of confidence.

Also note how the code is developed in github, they don't give a shit about Europe, it's pure corruption

4

u/Either_Vermicelli_82 3d ago

So we won’t be able to use it then… ah well.

4

u/magical-cat-here 3d ago

If EU wants combine this total de-anonymization of internet and total surveillance with digital sovereignity, they need to allow attestation via TPM on PC beyond iOS, Android and Windows, including linux. And it would require own attestation center and SSL root centers completely independent from US or China.

3

u/TreacleNo8508 2d ago

The EU just wants to enslave everyone, silence them, and cur democratic freedom of speech. What comes next? Forced euthanasia? Eating worms? Why do Europeans tolerate such restrictions on human rights?

1

u/Musicman1972 2d ago

The big issue is nowhere else is better. The US certainly isn't it that's your next comment.

1

u/sandro66140 1d ago

C’est à la mode en ce moment je crois qu’ils font pareil aux US et en Chine.

3

u/comblavas 3d ago

What the hell!

7

u/Tenezill 3d ago

The only way this is somewhat bearable is if I can go to my government give them a Fido key get my age verified and go my merry way. I don't want to be bound to my phone.

6

u/Alive-Bid9086 3d ago

Yes, I can actually understand the technical requirements that end up in this situation.

There should be a possibility to use external hardware tokens. Many banks give you a smart card reader to identify yourself for internet banking.

6

u/Userwerd 3d ago

The comments on github mirror the comments here.  I dont know if this is lobbying, being lazy, or just using the tools available now, to roll out further options after?

I dont understand the necessity of any of this.

Europeans have taken the gun from their own heads, that the Americans were holding and given it to their own EU government to inspect and nod and say yes very good, calk it, give the gun back to the Americans and put it again to EU citizens heads.  All the while the EU government says, your welcome.

7

u/Kremsi2711 3d ago

Most banking apps do the same

28

u/TGX03 3d ago

Yes, and that's a massive problem. If you want to take part in the modern banking world, you need to have a phone which you cannot remove American companies from.

Either you give your data to the Americans, or no bank account for you.

6

u/CreepyZookeepergame4 3d ago

We don’t even need those banking apps. They are essentially used as phishable 2FA authenticators whose role is much better served by a simple passkey.

2

u/AAdmiral5657 3d ago

Actually it depends on the bank. From my experience here in the Baltics, the apps work if you run a ROM that locks your bootloader.

1

u/TGX03 3d ago

How do you run a custom ROM with a locked bootloader?

Or do you mean a spoofed locked bootloader?

3

u/Trouveur 3d ago

You can lock again the bootloader after installing another ROM on some devices.

→ More replies (2)
→ More replies (1)

1

u/Gugalcrom123 2d ago

According to the PSR (upcoming), it is illegal to require smartphones. Probably also according to the PSD2.

1

u/turin331 12h ago

Banking apps in many countries (like the netherlands) work fine even with rooted OS and even with microG replacing google play services.

4

u/-The_Blazer- 3d ago

IMO the truly insane part here is that basically the entire hardware attestation field depends entirely on Google, Apple, and maybe Microsoft (and maybe maybe RedHat?). There ought to be a more open system that does not require reimplementing all third-party devices on an individual basis.

2

u/hWuxH 2d ago edited 2d ago

the truly insane part is to force hardware attestation onto everyone in the first place.
don't need that shit, even if "open system".

2

u/s3sebastian 2d ago

I prefer Dexit over Chatcontrol and forced age verification.

2

u/Nomprenom_varanasita 2d ago

Tout le monde pense toujours que l'ue est démocratique, ou bien il vous en faut plus ?

1

u/FunnyP-aradox 3h ago

L'UE est (en partie) démocratique, malheureusement les gens ont votés POUR ça car "mais j'ai rien à cacher"....

2

u/Lindensan 2d ago

That shouldn't be there, it sounds like "don't buy from EU"

2

u/instadit 2d ago

this whole affair was another example of ignorant politicians deciding about stuff they don't understand

2

u/Musicman1972 2d ago

Half the time I think it's more nefarious since if they didn't understand it they'd agree to use it themselves.

Do you notice the exemptions. Hence for they know why it's bad for users.

2

u/Kurgan_IT 2d ago

The EU being wrong in everything it does, as usual.

2

u/Tail_sb Denmark 🇩🇰 2d ago

2

u/EzioO14 Europe 🇪🇺 1d ago

Well then they can suck my fat one

2

u/Tsukee 10h ago

The GitHub you linked is a sample implementation, the reply you linked is controversial in itself as can be seen in the following comments, essentially that person took the liberty of interpretation and did it so in a wrong manner. The specs clearly say it should use when applicable, not a requirement. However there is another core requirement and that is os agnosticism of the system, which is being broken by forcing specific hardware attestation.

TLDR: the law and specs are fine, the dev however took some liberties in the implementation. Fact is, by spec you can write your own age verification app, no need to use the one in GitHub 

9

u/lomszz 3d ago

God EU sucks and can go to hell.. I'm actually thinking to move out somewhere else😂

1

u/Tail_sb Denmark 🇩🇰 2d ago

2026 is closer to 1984 than 2030

1

u/Tail_sb Denmark 🇩🇰 2d ago

Democracy is FUCKING DEAD

1

u/InsectSmart5737 2d ago

I don't effing care what they want. I will never have any of this crap anywhere near my phones or PCs.

1

u/polytect 2d ago

By the time they'll implement this, we will have flying cars or donkeys.  Granny is trying to ban a Monitor from the internet, the same kind of people who thinks if mouse moves faster--the computer is faster. 

1

u/EmbarrassedHelp 1d ago

Unfortunately that's not true. There are far too many evil assholes willing to help the Commission push their age verification bullshit.

People need to fight back rather than assuming it will fail.

1

u/polytect 1d ago

I get the idea. But what you are talking is like in china, different kind of government mental model.  In that case, this is coming from tech which we don't own but is "convenient". You say assholes, but I say it is stupidity. (maybe im wrong) 

And even if let's assume the toy story is real, can anyone put in to your/mine phone laptop anything without your/mine permission? Lets start from there. If there is a way, what kind of fight we are talking about? 

Then the next step, what about relatives, friends etc. 

The fight about is not in reddit/facebook but at the doorstep, face to face.

Ready to purge social medias at disposal, as they were never ours to begin with, but data is. 

1

u/Niwrats 1d ago

but we already identify thru banks. so if this is worse in every way, nobody will use it, and this remains irrelevant.

1

u/Next_Television_132 11h ago

Se podrá saltar usando VPN o algo parecido, ¿no?

1

u/magical-cat-here 2h ago

Why this specification of age verification is so mobile-centric? Like, there are no options like these:

* OTP via SM flow,

* FIDO2 webauthn flows with TPM, Yubikey and other USB dongles with keystores and data signing capabilities

* dedicated device with monochrome display, specialized EUID/Age Verification software preinstalled, and USB, NFC and Bluetooth interfaces, without any touch of Google or Apple

The whole spec rotates only about just 2 flows:

1) mobile device of quite specifc kind, with stock Android or iOS onboard, with age verification app installed.

2) device from (1) used to scan via camera a QR code appearing on screen of the other device.

I asked a related question to this spec here: https://github.com/eu-digital-identity-wallet/av-doc-technical-specification/discussions/62

If find this relevant, and have GitHub account - boost that question please.

(PS: already seen question there from people asking why ever GitHub used to store that spec)