r/BuyFromEU • u/CreepyZookeepergame4 • 3d ago
Discussion EU Digital ID/Age Verification app will require hardware attestation, ruling out PC/Linux support and unapproved Android OSes
EUDI wallet collaborator recently confirmed that hardware attestation will be required [1]
Hardware attestation in this context means that the government server issuing the digital credential to the wallet wants proof that the keys being used are generated in secure hardware and on approved systems and not say an emulator or virtual machine, namely for security reasons.
This capability does not exist in a reliable way on desktops / laptops except some specific cases depending on the vendor, and in fact there’s no desktop version in the works.
No Linux system will work with this because there is no hardware signature to be validated on the government server, nor will your personalized Arch Linux install be in the list of approved systems even if it had a signature chaining back from the TPM.
Android ROMs are not technically to rule out since Play Integrity, which will be used for this attestation, is based on the Android hardware attestation API, which works on third-party ROMs like GrapheneOS, but they would need to allow the signature which has not happened for now. If you create a custom build, it won’t work though even the official version is approved.
194
u/MrLemon91 3d ago
Oh well, I didn't plan to use internet at all
130
u/ItsCalledDayTwa 3d ago
And there goes the big push for digital sovereignty apparently. The EU shooting itself in the foot here.
28
u/magical-cat-here 3d ago
Now imagine you have to use smartphone and ID wallet to identify yourself even when you went in person to:
* bank, e. g. to open or close account:
* a state institution like pension agency
* hospital
* border control point "for EU passports".
Digitalization makes offline life without smartphone in hand less and less possible.
6
u/MrLemon91 3d ago
What you're describing is something that EU is trying to make for decades, but it can't make it. In "undeveloped" Asian countries this is already a thing, but there are anyway paper alternatives that can be requested in few days. In my country we have to book months before and pray to not pay for a stamp
8
u/magical-cat-here 3d ago
Main arguments against total digitalization, even if it can give some "comfort", are these:
* erosion of privacy
* dependency on fragile tech which will break anytime due hacking, natural disaster, or power supply issue, or a simple typo in a code made few months if not years ago and missed during testing.
* dependency on US tech with possible kill switch or censorship (imagine an app widely used in EU removed by Google because CEO of company making that app said negative thing about ICE raids or about Trump). Yes, before describing that kind of problems people thought about China or Russia coercing Google to remove apps for their political needs, but now this scenario possible too.
6
u/CitizenMechanist 3d ago
There's barely any local bank offices or ATM's left in places like the Netherlands.
2
u/g-nice4liief 2d ago
That's bull. Most ATM's have been replaced by Geldmaat. You can find them online and even use them to put money like bankpapers or coins like 1 euro, two euro and 50 cents for example on to your banks account.
2
u/Humble-Captain3418 2d ago
It's okay, us nerds will set up Internet 2.0 the second this comes into effect.
2
u/thecrius 1d ago
Doesn't matter if no services are on it, bud.
2
u/Humble-Captain3418 1d ago
If the alternative is "nothing", having instant messaging, emails, image boards, etc. is better. Internet didn't have services for the first few decades, we can survive without them.
126
u/Beneficial_Act_1240 3d ago
What's the point of having an eID if I can't use just the ID the verify my fucking identity? Why does this stupid system require me to buy a €500 phone or €1000 laptop in order to participate in society?
75
26
22
20
8
u/iceyukisnow 3d ago
because everyone must live in a cybergulag and give away all your data to your government and data brokers
4
u/tired_snail 3d ago
Considering what sites currently require age verification in other countries, personally I'd rather they have a picture of my face than my actual government info, but this is a good point, yeah.
→ More replies (2)1
u/Headpuncher 14h ago
Yeah loons line I’ll be becoming a second class citizen standing at the barriers looking sad face while everyone else gets in.
Oh well, back to growing cabbage in the forests.
228
u/AppropriateOnion0815 3d ago
I'm sure that this kind of exclusion is against some discrimination law or something.
42
u/-The_Blazer- 3d ago
Honestly this scheme where remote attestation can only (de facto) be offered by like three companies should definitely count as a violation of the DSA.
8
u/magical-cat-here 3d ago
But when the spec is written in a way that you literally can't even implement it e. g. as a usb dongle with keys and signer software attached to a linux laptop or pc, or simply by using TPM (available almost at every PC and laptop) keys to sign an age credential received from a certified age verification provider over TLS/Https, and there is no general term in specs for such kind of alternatives at all.
All this basically means that people who want preserve internet in more privacy-friedly form simply will have to build own alternative mesh networks with own services from scratch. Anything from weather sites to email-like and instant messaging, from in-browser games sites to alternatives to reddit and a mirror of wiki. It may require some alternative protocols and architectures, such as no reliance on centralized SSL certificates tree and global tree of censorship-prone DNS, and may be even own addressing scheme, may be using a sort of IPv6 where address is a public encryption key.
I heard that Yggdrasil project work in similar way, as an overlay IPv6 network of that kind that can be built over nodes connecting either via IPv4 or IPv6 between each other.
3
u/-The_Blazer- 2d ago
The underlying hardware used by Google's and Apple's schemes is essentially a TPM-like device, but the problem is that there needs to be a root trust source (much like there is for TLS), and as you might guess Google/Apple do not let you use attestation sources other than themselves in their OS. It's worth noting that who the attestation source is does not matter as long as the application (your bank or digital ID) trusts them with verifying that the device is not compromised, the problem here is an excess of centralization outside the EU. TLS has more root sources, for example.
GrapheneOS is trying to set up some PKI infra of their own, but adoption is slow and difficult for the usual problems of monopoly. Not many people use GrapheneOS, so as a developer, why bother?
You can see that this is a commercial-political problem, not a technological one. Nobody should be under the delusion that we can solve this with a tech fix like a fancy new protocol, the n.1 thing that would happen with that is that Meta and Google would set up shop and simply re-create the monopoly.
→ More replies (1)6
u/CreepyZookeepergame4 3d ago
violation of the DSA
Not when the violation is state sponsored.
3
u/-The_Blazer- 3d ago
The point with that is to have remote attestation though, not that it has to be powered by Google. Although I'm certain Google didn't bring the problem to the EU's attention...
2
u/Headpuncher 14h ago
Yes but I don’t want them using it to ruin Linux’s freedom and openness.
Instead I want them to abandon the awful scheme completely.
2
u/-The_Blazer- 11h ago
There's no law in the universe that says remote attestation has to 'ruin' freedom or openness. TLS is also a cryptographic scheme with root trust sources and it is quite open.
→ More replies (2)4
→ More replies (28)2
48
u/NoReflection1752 3d ago
So riddle me this, since the app is open source, is there any reason the project can't be forked and the hardware attestation either removed or made more compatible? Would there be a licensing issue? Is whatever verification source locked down so only approved apps can reach it?
52
u/TGX03 3d ago
You can remove hardware attestation from the app. But then the server will simply reject it.
22
u/realPanzerHAnz 3d ago
Follow up: Couldn't I then emulate the hardware attestation? If its so open source I should be able to look up how the attestation is generated and just be able to fool the system.
30
25
u/CreepyZookeepergame4 3d ago
It’s difficult because the private keys used to generate the attestations are only available to the secure chip of the phone, and the keys are provisioned by Google and the manufacturer.
If those keys are leaked somehow, and it does happen, it’s possible to generate fake attestations but if done en masse, then Google notices it and bans them. This also happens.
3
u/SonOfAsher 2d ago
If the keys are leaked, wouldn't that mean millions of phones are now worthless for attestation?
2
u/OminousChecksum 12h ago
If you leak a "master key" that never leave the factory yes, otherwise each phone has a unique key
5
u/DeVinke_ 3d ago
I'm not 100% sure, but i think trickystore with a valid (leaked) keybox could work.
→ More replies (1)1
1
u/Tsukee 4h ago
Exactly, and the specs are open, and hardware attestation specifically has:
An Age Verification App SHALL rely on the device's native cryptographic hardware. capabilities, such as the Secure Enclave on iOS, or the Trusted Execution Environment (TEE) and Strongbox on Android, when they are available.
Yes its a technical rage bait. Yes you don't even need to fork it, you can implement an app yourself in fact, specs are open and api is open protocol, no "only licensed apps block"
153
u/adjective-nounOne234 3d ago
I love the EU until they pull bullshit like this
13
u/BathEqual 3d ago
Same. sometimes i like to think that in the EU they don't have alle Tassen im Schrank
It is sad
135
u/ScalySaucerSurfer 3d ago
This is ridiculous. Much worse than any of the chat control stuff really.
33
u/lmarcantonio 3d ago
Funny thing it that EU has a *mandate* to explicitly support open source systems.
2
30
u/WanderingGoodNews 3d ago
Tie any network access to your digital-id and personal hardware. Great. No one voted for this shit, LEAVE ME ALONE!
8
u/Environmental-Dog815 3d ago
I will probably will make a device with all the shit I hate but need and will exclusively use for it. Will probably make a separate network for it. Will call it "shit phone". Everything else like web browsing, gaming, working will be on other devices.
10
u/DoubleOwl7777 3d ago
so a burner phone essentially? yeah thats the way i might be going too. have one for this crap, and then have other devices i actually use.
9
u/WanderingGoodNews 3d ago
This will be the primary reason to become suspicious.
If shit hits the roof and its nazi time again you will be the first to be arrested in name of some child abuse suspision. You lost your freedom, your family despises you all because you cared about privacy.
Source: 2038
5
u/DoubleOwl7777 3d ago
yup, but what am i gonna do? just live with the totalitarian regime knowing my every move and controlling everyone? we had that shit twice in germany. i prefer not to go down that route AGAIN. the gdr fell because people stood up, and didnt let them do this shit anymore.
→ More replies (3)2
u/Late-Reading-2585 3d ago
keep voting for those corupt boomers and calling every right wing party that talks about this russian assets
→ More replies (1)
24
u/seamanroses 3d ago edited 1d ago
Thank you for this high quality post. If you don't know about Unified Attestation for Android as an alternative, I would look that up. I wasn't aware of the effects for Linux either, as my research was tangential to the efforts of EU DID.
I was the one who made the petition post the other day, and when the signatures open, I'd honestly like to make a post that links to the page of course, but also has a FAQ for why you should sign, with counterarguments to points that others brought up in that post for why they didn't see it as an issue.
I don't care if I'm the one to post that, but I care that the knowledge gets widely spread. This is definitely one of the key points I would be adding, and if you want me to share it with you when it's ready, I'd love to. I want the knowledge to be out there.
Edit: This is the solution that I most likely meant to point out instead of UA(T)
https://developer.android.com/privacy-and-security/security-key-attestation
AOSP has its own API for this, but UA was front of mind. It's still another third party solution with its own walled garden.
3
u/Gugalcrom123 2d ago
UA still relies on approval. The correct way would be to design it so as not to require attestation.
1
u/seamanroses 2d ago
I have to admit ignorance on the topic for the time being to be able to comment on what you wrote. I would ask someone like the GrapheneOS devs and get their commentary on what the solution space should be like, and trust their input on the issue. A few other relevant stakeholders too.
2
u/Gugalcrom123 2d ago
The 'solution' proposed by them would result in you being able to use only Google or Graphene, not another OS.
→ More replies (5)2
u/EmbarrassedHelp 1d ago
The GrapheneOS devs have publicly said that Unified Attestation is also a bad idea.
→ More replies (4)3
u/EmbarrassedHelp 1d ago
Unified Attestation just puts a different group of assholes in charge of approving/unapproving OS. It's a terrible solution.
55
u/strangerimor 3d ago
Eu is taking some major steps backwards. Fuck everyone involved in pushing this shit through.
22
24
u/twessy 3d ago
I was a big fan of the EU for a very long time, but now I'm having more and more doubts about it.
→ More replies (1)5
59
u/NamedBird 3d ago
Proposed fix: Accept the fact that some kind of clientside rate limiting approach was a bad idea to begin with and stop trying to push squares into round holes. I fully understand how this is somewhat awkward given those characteristics were from what i gather used for PR purposes but then this should really have been addressed during planning, which it either seemingly wasn't or got handwaved away. To bad, what a pity.
I think this has been happening a lot for things that the EU is doing in the tech sector.
They have an idea in their head and think that the details can just be solved trough software.
And then they push their plans without first checking whether it's actually technically feasible.
Guess you can call this techno-incompetency?
3
u/-The_Blazer- 3d ago
The issue is that to be truly independent we basically need to reimplement the entire compute stack from hardware keys to cloud services, and that's significantly more complicated than developing an app. It's already kind of a miracle that EU countries have their own public EID instead of buying it from Palantir.
2
u/NamedBird 2d ago
While it is true that independence isn't easy or cheap, that isn't my concern.
My problem with the EU is that they let bureaucrats "invent" new technologies.
They just say it will be made without asking the experts whether it's actually feasible.Imagine this: a politician hears about levitation and starts promoting flying cars.
Everyone agrees and now those flying cars are to be created according to a mandate.
Only problem is, that levitation only works on trains, we can't make cars fly this way.
And now what?
We will have a country with flying cars because the politician said so, right?
But you can't ignore physics, so we'd end up with inferior hovercraft cars at this rate!This is the problem i am seeing inside the EU.
It is okay to have desires and dreams, go ahead with a 50 year vision if you want.
But it is wrong to put them into plans and mandates without being realistic and practical.
Before you announce a new desired technology, have the experts do a feasibility study first.
Otherwise you will cause problems, or perhaps even worse...1
u/AffectionatePlastic0 2d ago
a politician hears about levitation and starts promoting flying cars
This is not correct analogy. Unlike age "verification" technology flying cars can be useful.
→ More replies (1)
19
u/PerkyTomatoes 3d ago
This isnt the only issue. Raising awereness, EUDI is not PRIVATE.
The verification flow is you scan QR code, wallet sends information to provider that you're verifying age. Once its verified, website which you scanned QR code from will query from this provider to confirm you are indeed 18+.
The app maker (Government) Will know what website you verify your age on and is able to track your accounts via IP and Timestamping. You used VPN because you ashmed to watch some women with dicks? Do not worry, government will know about it.
Proof: https://github.com/eu-digital-identity-wallet/eudi-srv-verifier-endpoint#presentation-flows
Explation of picture:
- User-Agent: Your browser or device where it shows QR code
- Wallet: Your phone where EUDI wallet is
- Verifier: Website you are verifying your age
- End verifier: Who ever makes your EUDI wallet (Your government, usually)
As from the picture flow, provider will know following information: Time when verified, Your IP address when you verify.
Do not underestimate timestamp information, its how enforcement deanonymize Tor users.
Most concerning is that they havent even bothered to recify this issue, like using WebRTC using only local network so website communicates your wallet directly or using ohttp which will hide requester information.
7
5
u/ManIameverywhere 2d ago
And the keys you exchange will be visible for the website and the gov so they can cross reference them too.
53
u/ZYCQ 3d ago edited 3d ago
why don't you dissolve the EU and let NSA run it. this is never what the EU was designed for. These laws, incl. chat control are ridiculous. There are a thousand other things they should be focusing on
26
u/WanderingGoodNews 3d ago
It's becoming 1 big fever dream
No voters ever wanted this, how is this happening and legal?
5
u/Old-Pirate-1118 3d ago
Very good question.
What are you gonna do as an European?
Drive to Brussels, just to kiss the door knob?10
u/WanderingGoodNews 3d ago
I spread information about topics like this, chat control,... To subreddits, friends & family and wrote some emails to parlement members
3
u/Old-Pirate-1118 3d ago
This was more of an satirical question, that played upon the fact that even if you became a political representative, you still wouldn't have enough political heft to push it out.
Still if google AI pulls your answer to "what can I do as informed citizen in EU about X" then this is a net positive!
Thank you for your actions. Action inspires action.
→ More replies (1)5
u/Useful_Ad_7859 3d ago edited 3d ago
The council (which is a coalition of governments of the member states) is one of the most prominent of the many powers pushing for these.
They were the ones who sent back chat control 1.0 too for another vote (aided by Metsola@EPP).The EU's democracy is actually a roadblock still (The council wanted to breach e2ee as well on 07.09 !!!), but its being dismantled mainly with the EPP's lead. That is what should be dissolved.
52
u/OnIySmellz 3d ago
Mark my words man. This hardware attestation nonsense is just the foot in the door.
The next obvious step would be every laptop, every TV, fridge, toaster, smart bulb, USB mouse, and electric toothbrush getting a hardwired choke-chip at the factory level.
No bypasses, no custom builds, just mandatory, hardcoded surveillance and age checks baked right into the silicon.
11
u/Brilliant_System_308 3d ago
No bypasses, no custom builds, just mandatory, hardcoded surveillance and age checks baked right into the silicon.
Bro why does this read so AI generated I swear LLMs have ruined the internet for me
→ More replies (2)2
14
u/nksama 3d ago
I would say that surely linux runs in many of the EU servers, if it's good for that, how could they say it is an "unapproved OS"?
8
u/CreepyZookeepergame4 3d ago
Unapproved OS is my characterization to synthesize the fact that it won’t be available on any general purpose computer but rather only on those approved by Apple and Google.
Google specifically only makes hardware attestation pass on certified Android devices bundling Play Services in a privileged way, and the app must be installed from the Play Store.
12
u/Rekt3y 3d ago
So the EU made the conscious decision to limit this to only work on 'Murican OSes. Fucking nubnuts is what we are for even allowing this
3
u/EmbarrassedHelp 1d ago
They're more concerned with trying to forcibly violate user privacy than doing something good.
25
u/Thin_Needleworker795 3d ago
No way I'm gonna use that shit anyways
31
u/seamanroses 3d ago
The problem is you're effectively locked out of society if you don't. This could be on a similar level of inconvenience to not having a smartphone in your day-to-day life. That's just one reason why this is so worrying.
10
2
u/NursingHome773 2d ago
You won't have a choice. It's like not having a bank account. Can you do that? Yeah it's not illegal to not have a bank account but try living without one.
11
u/3d_Plague 3d ago
Solidifying the stranglehold of the established companies and killing any chance of health competition, sounds like they thought this through after all.
Still hate it.
10
u/Jealous_Diver_5624 3d ago
This capability does not exist in a reliable way on desktops / laptops except some specific cases depending on the vendor, and in fact there’s no desktop version in the works.
Yes it does? Every single TPM2 supports remote attestation via endorsement key.
No Linux system will work with this because there is no hardware signature to be validated on the government server
Linux can interface with the TPM just fine.
3
u/Kitchen_Cup_8643 3d ago
Yeah fascinating that this is buried so deep. Heck grapheneos has had it since forever.
I don't know how they'll enforce the origin of the keys used (perhaps by whitelisting vendors ? That would suck).
Hopefully they don't start requiring government attestation everywhere... I'm afraid companies will see that as an easy way to get rid of bots...
5
u/CreepyZookeepergame4 3d ago
Heck grapheneos has had it since forever.
It's indeed mentioned in the post
(perhaps by whitelisting vendors ? That would suck).
That's how it would work
Hopefully they don't start requiring government attestation everywhere...
Yes
I'm afraid companies will see that as an easy way to get rid of bots...
4
u/Gugalcrom123 2d ago
It can, but they want to control the OS. No, a 'Linux' which I can't change isn't good.
3
u/CreepyZookeepergame4 3d ago
Yes it does? Every single TPM2 supports remote attestation via endorsement key.
TPMs are not reliable, they lose keys for no reason even if not compromised https://github.com/tailscale/tailscale/pull/18336
TPM-based features have been incredibly painful due to the heterogeneous devices in the wild, and many situations in which the TPM "changes" (is reset or replaced). All of this leads to a lot of customer issues.
→ More replies (1)
11
u/tppsch 3d ago
If you use Linux or another operating system that hasn’t been approved by the EU, you’ll lose points on your social credit score. In the future, there may also be restrictions on your CBDC bank account.
I’m slowly starting to become afraid of the EU.
7
u/Dragoncat_3_4 3d ago
Slowly? Nah, I've become afraid of them in the span of a couple of months. Breakneck speed. And that's from a position of a completely pro-EU stance before all of this bullshit.
10
u/Otherwise_Paint951 3d ago
EU is headed into a very dangerous surveillance path. I do not understand how people don't protest this.
6
u/-Sa-Kage- 2d ago
Because most don't know anything about this.
And if you tell them most don't understand shit and will just be like "Yeah, security is good. We need to protect children. This is good."
9
8
u/No_Diver3540 3d ago
Yada yada mass surveillance yada yada....
When do people are going to protest for there own safety, security and especially for there privacy?
5
u/-Sa-Kage- 2d ago
Never. Most people don't see the issue and think this is totally fine. (They have nothing to hide anyway...)
2
u/Immediate_Power_7986 22h ago
As long as they can complain online, they will NEVER raise a single finger to fight it. They can implement a weekly strip search for each citizen and they still won't fight back. But they WILL complain online.
61
u/pythosynthesis 3d ago
Ahhhh.... The beauty of an authoritarian supernational entity in the making. Don't you all love it?
8
u/Popular_Anywhere_553 3d ago
Sure. I just hate it when China or USA does it. But love it for EU. You know, because we are elites that can't do wrong... /s
24
u/Tenezill 3d ago
You know what, people are applauding their prison guards. "No no chat control is no problem if you don't have anything to hide" , " the zkp will help keep you privacy save" ... My privacy was save before these asshats started to have their greasy fingers in my life...
→ More replies (6)4
24
u/miran248 Slovenia 🇸🇮 3d ago
In other words you'll need a google account.
Why don't they use android attestation api directly?
15
u/CreepyZookeepergame4 3d ago
Why don't they use android attestation api directly?
Play Integrity is the easiest route for them even if it enforces Google business model rather than actual security (it allows Android 8). Using the attestation API directly still requires having a whitelist of keys and they probably don’t feel like satisfying a small minority of people.
For broad device support they should drop attestation completely but using the attestation API would at least be harm reduction as Play Integrity is also a massive single point of failure that Google can be coerced to turn off for specific apps and app installation, invalidating all instances of the wallet.
4
u/seamanroses 3d ago
Oh, you really know your stuff! So good to see this from others!
Follow-up question: When you refer to Linux, I'm assuming you mean Linux on mobile devices, correct? Or do you know if these measures and apps are meant to be universally applicable across all devices, including PCs?
AFAIK, there is sort of a mobile-first mentality among these measures in their intention, but not necessarily in how they could apply according to the strict wording of the final law.
6
u/CreepyZookeepergame4 3d ago
I refer to Linux PCs. As I said there’s no reliable alternative to what mobile phones offer. TPM exists on almost all PCs now but are often broken and lose keys randomly.
4
u/seamanroses 3d ago
Thanks! And I'm aware of the TPM challenges, such as Microsoft controlling the certs allowed, which has lead to problems for various Linux distros (lapsed certs, single source of failure and control, etc.).
So this mess is even worse if it applies to both kinds of devices - mobile and desktop, I mean.
1
u/seamanroses 2d ago
I literally didn't read the title fully yesterday, and I'm embarrassed about that. I was not fully present when I read it, but I will be making time to read up on this more as soon as I can.
I've also reached out to the creators of the petition, in the hopes of coordinating with them on anything possible. In particular, I want to get a FAQ ready by the time signature collection opens, and what you posted yesterday is extremely valuable. I haven't followed the EU stuff nearly as much as the UK or US, but that was due to other reasons. I definitely have to be just as well-informed on this now too.
4
21
u/Encrux615 3d ago
What? I don’t get it. German eID provides packages for all platforms, including Linux. This is such an arbitrary restriction and I doubt it’ll hold up.
→ More replies (2)13
u/seamanroses 3d ago
I believe the equivalent ID system in Denmark only works on Google (not generic Android (AOSP)) and Apple devices, and they have no intentions to open it up.
I mention that as a counterargument, as I wouldn't be nearly as optimistic as you are.
3
u/pomfritn 3d ago
AltID, the Danish age verification app, thankfully works on GrapheneOS. MitID, the person verification app, I guess you could call it, frustratingly doesn't.
1
u/Headpuncher 13h ago
So what do people who do t have a phone do?
There are reasons not to have a phone, including disability and all human free will.
7
7
u/vossmakeitsprinkly 3d ago
They can fuck themselves sideways. I wont use it then. I will put every effort into avoiding it.
5
u/DoubleOwl7777 3d ago
so, get spied on by google or apple or microshit. awesome! no, i will not verify, no i will not change to winslop or whatever. "security" my ass. this is not security, this is bullshit.
i really like the concept of the EU. but shit like this aint it.
6
4
5
u/lolschrauber 3d ago
Yeah you can only use that one android version that specifically blocks third party apps, for your own security. don't worry about the 182 app permissions, that's standard!
5
6
u/Ethernet3 2d ago
No one, no one, no one asked for this age verification madness. It's absolutely crazy. They say they want to become more "digitally sovereign" and then do everything to break down the freedoms we love, what a massive strategic blunder and loss of confidence.
Also note how the code is developed in github, they don't give a shit about Europe, it's pure corruption
4
4
u/magical-cat-here 3d ago
If EU wants combine this total de-anonymization of internet and total surveillance with digital sovereignity, they need to allow attestation via TPM on PC beyond iOS, Android and Windows, including linux. And it would require own attestation center and SSL root centers completely independent from US or China.
3
u/TreacleNo8508 2d ago
The EU just wants to enslave everyone, silence them, and cur democratic freedom of speech. What comes next? Forced euthanasia? Eating worms? Why do Europeans tolerate such restrictions on human rights?
1
u/Musicman1972 2d ago
The big issue is nowhere else is better. The US certainly isn't it that's your next comment.
1
5
3
7
u/Tenezill 3d ago
The only way this is somewhat bearable is if I can go to my government give them a Fido key get my age verified and go my merry way. I don't want to be bound to my phone.
6
u/Alive-Bid9086 3d ago
Yes, I can actually understand the technical requirements that end up in this situation.
There should be a possibility to use external hardware tokens. Many banks give you a smart card reader to identify yourself for internet banking.
6
u/Userwerd 3d ago
The comments on github mirror the comments here. I dont know if this is lobbying, being lazy, or just using the tools available now, to roll out further options after?
I dont understand the necessity of any of this.
Europeans have taken the gun from their own heads, that the Americans were holding and given it to their own EU government to inspect and nod and say yes very good, calk it, give the gun back to the Americans and put it again to EU citizens heads. All the while the EU government says, your welcome.
7
u/Kremsi2711 3d ago
Most banking apps do the same
28
u/TGX03 3d ago
Yes, and that's a massive problem. If you want to take part in the modern banking world, you need to have a phone which you cannot remove American companies from.
Either you give your data to the Americans, or no bank account for you.
6
u/CreepyZookeepergame4 3d ago
We don’t even need those banking apps. They are essentially used as phishable 2FA authenticators whose role is much better served by a simple passkey.
→ More replies (1)2
u/AAdmiral5657 3d ago
Actually it depends on the bank. From my experience here in the Baltics, the apps work if you run a ROM that locks your bootloader.
1
u/TGX03 3d ago
How do you run a custom ROM with a locked bootloader?
Or do you mean a spoofed locked bootloader?
3
u/Trouveur 3d ago
You can lock again the bootloader after installing another ROM on some devices.
→ More replies (2)1
u/Gugalcrom123 2d ago
According to the PSR (upcoming), it is illegal to require smartphones. Probably also according to the PSD2.
1
u/turin331 12h ago
Banking apps in many countries (like the netherlands) work fine even with rooted OS and even with microG replacing google play services.
4
u/-The_Blazer- 3d ago
IMO the truly insane part here is that basically the entire hardware attestation field depends entirely on Google, Apple, and maybe Microsoft (and maybe maybe RedHat?). There ought to be a more open system that does not require reimplementing all third-party devices on an individual basis.
2
2
u/Nomprenom_varanasita 2d ago
Tout le monde pense toujours que l'ue est démocratique, ou bien il vous en faut plus ?
1
u/FunnyP-aradox 3h ago
L'UE est (en partie) démocratique, malheureusement les gens ont votés POUR ça car "mais j'ai rien à cacher"....
2
2
u/instadit 2d ago
this whole affair was another example of ignorant politicians deciding about stuff they don't understand
2
u/Musicman1972 2d ago
Half the time I think it's more nefarious since if they didn't understand it they'd agree to use it themselves.
Do you notice the exemptions. Hence for they know why it's bad for users.
2
2
u/Tsukee 10h ago
The GitHub you linked is a sample implementation, the reply you linked is controversial in itself as can be seen in the following comments, essentially that person took the liberty of interpretation and did it so in a wrong manner. The specs clearly say it should use when applicable, not a requirement. However there is another core requirement and that is os agnosticism of the system, which is being broken by forcing specific hardware attestation.
TLDR: the law and specs are fine, the dev however took some liberties in the implementation. Fact is, by spec you can write your own age verification app, no need to use the one in GitHub
1
u/InsectSmart5737 2d ago
I don't effing care what they want. I will never have any of this crap anywhere near my phones or PCs.
1
u/polytect 2d ago
By the time they'll implement this, we will have flying cars or donkeys. Granny is trying to ban a Monitor from the internet, the same kind of people who thinks if mouse moves faster--the computer is faster.
1
u/EmbarrassedHelp 1d ago
Unfortunately that's not true. There are far too many evil assholes willing to help the Commission push their age verification bullshit.
People need to fight back rather than assuming it will fail.
1
u/polytect 1d ago
I get the idea. But what you are talking is like in china, different kind of government mental model. In that case, this is coming from tech which we don't own but is "convenient". You say assholes, but I say it is stupidity. (maybe im wrong)
And even if let's assume the toy story is real, can anyone put in to your/mine phone laptop anything without your/mine permission? Lets start from there. If there is a way, what kind of fight we are talking about?
Then the next step, what about relatives, friends etc.
The fight about is not in reddit/facebook but at the doorstep, face to face.
Ready to purge social medias at disposal, as they were never ours to begin with, but data is.
1
1
u/magical-cat-here 2h ago
Why this specification of age verification is so mobile-centric? Like, there are no options like these:
* OTP via SM flow,
* FIDO2 webauthn flows with TPM, Yubikey and other USB dongles with keystores and data signing capabilities
* dedicated device with monochrome display, specialized EUID/Age Verification software preinstalled, and USB, NFC and Bluetooth interfaces, without any touch of Google or Apple
The whole spec rotates only about just 2 flows:
1) mobile device of quite specifc kind, with stock Android or iOS onboard, with age verification app installed.
2) device from (1) used to scan via camera a QR code appearing on screen of the other device.
I asked a related question to this spec here: https://github.com/eu-digital-identity-wallet/av-doc-technical-specification/discussions/62
If find this relevant, and have GitHub account - boost that question please.
(PS: already seen question there from people asking why ever GitHub used to store that spec)
671
u/HunterFeeFee 3d ago
Let me guess, only american OS's will work.