EU Age Verification Project Mandates Hardware-Bound Attestation

All this ostensibly to keep teenage boys from watching Pornhub (when parental controls already exist).

The real reason, of course, is to force people to connect strong real-life identifiers to online activity. Mobile first, then Windows. Then Linux is too weak to oppose on its own, and will adapt or die.

I don't understand where the all the EU anti-trust and anti-corruption regulators are here. _Governments_ enforcing that you have a Google or Apple account to participate in society is transparently absurd.

This isn't only a digital sovereignty issue, it's also an anti-competition issue.

> Linux is not explicitly banned. Desktop Linux users could access a website and scan a QR code using a supported mobile wallet.

That's a weird way of putting it. You'll basically need a second non-Linux device if you want to use Linux.

If your reason for using Linux is "I want to continue using old hardware instead of quickly-obsoleted devices", then you're shit outta luck: you'll have to buy a (potentially second) device from one of those vendors who'll use the profits to further lobby against your rights.

note that hardware attestation does not utilize ZKP or blind signatures. so your hardware ID is technically exposed.

usually to make use of the exposure multi-party collusion is required. Google or Apple attestation intermediaries (they convert your static certificate into an ephemeral one) would need to be logging information and when combined with information from the party you attested to (done with the ephemeral certificate) they will have your unique device identifier (the unchangeable certificate burned into the silicon).

it's doubly insidious because nothing is preventing the manufacturer from recording the certificate identifier and connecting it to an order ID for the device. so not only can they tie together multiple accounts, they could tie it to the identity that purchased the device.

on mobile devices you can't even restrict this functionality as it's exposed via API (remote attestation and also DRM license request handshake initiation). not even grapheneos gives you to option to disable it.

also, the implication of the above is that there is no private way to have a google account on an android phone. they will know it's you or the previous owner of the device who sold it to you (makes VPN irrelevant).

It should be noted that this app is temporary. The EU is aiming for a digital wallet app that you can store your identity documents in and that you can use to prove facts about those documents to third parties, in a way where the third party gets no extra information--just what you chose to disclose (e.g., just your age or just your country) and that cannot be used to link your real identity to your using the site even if the site and the government share logs (this is called unlinkability).

That will not be fully ready until around 2028. They wanted the age verification available earlier and that is this app. It does not have unlinkability.

Here's the expected timeline.

The first version of the wallet app is suppose to be out by the end of this year or early 2027. It will still not be unlinkable because Apple's Secure Enclave and Android's StrongBox don't support the cryptographic operations needed for the methods that will eventually be used for that, BBS+ anonymous credentials or ZKPs. There is a variant of BBS+ that can achieve unlinkability on existing phones, but unfortunately the hardware security modules (HSMs) currently used by government when they issue you your identity credentials cannot handle BBS#.

In 2027-2028 they are supposed to upgrade the government servers so they can support BBS# or zk-SNARK and update the wallet to use those, achieving unlinkability and anonymous age (and other data) verification.

Here comes the European freedom and free speech. With Chat Control it’s even more hilarious. Compliance list, another European Commission, as always.

> a maintainer confirmed that hardware-bound attestation is a mandatory architectural requirement

Hardware-bound is not a problem, limiting that to only iPhones and some Android phones is. Plenty of hardware can keep a key safe and it doesn't need Apple's or Google's blessing.

> Linux is not explicitly banned. Desktop Linux users could access a website and scan a QR code using a supported mobile wallet.

Considering a significant part of the internet will be behind age verification gates, how are they imagining this to work? I should pull out my iPhone or Google Android phone and get its approval every time I want to visit a website?

The article mentions "approved applications". What role, if any, do apps play in age verification if it's implemented in hardware?

Related:

European "age verification" "app" forcing everyone to use Android or iOS

https://news.ycombinator.com/item?id=48903777

Stop Killing the Internet: No Digital ID and No Age Verification

https://news.ycombinator.com/item?id=49084938

There it is. That's what this "age verification" nonsense was all about. Predictably, the unceasing "think of the kids" rhetoric came down to THIS.

Absolute control over people's computers.

It's not your computer anymore, it's the government's.

We need another French revolution that gets rid of this corrupt EU regime for good.

I expect a gray/black market in TPM keys and the like will grow if this takes off, but hopefully the citizens will fight it very strongly before then...

...but then again, this is the EU, not the US.

Someone on HN suggested parents set devices up for their kids and Browsers and OS's gate by age. I haven't really been able to fault this idea.

State mandates verification and stuff like this makes me suspicious that this is much more than "protecting the children". More advocacy of alternative solutions please.

By an incredible coincidence, the (ex- ?) employee of a company known to lobby hard in the EU (Microsoft) and who's the author of a rube-goldberg kitchen sink many of you on HN loves so much (systemd), is now working on a system that's been described here as "an attack on general purpose computing". Attestations / Trusted Platform Module (TPM) / etc. are all in there:

https://news.ycombinator.com/item?id=46784572

How much do you love your systemd and the individual behind it now?

Can't wait to use your "amutable" Linux with hardware-bound attestation verifying your age now can you?

These people (the politicians behind such decisions, the people working on such platforms, those saying it's a good thing, ...) are enemies of freedom.

[flagged]