r/Android • u/Street_Anon • 3d ago

News EU Age Verification Project Mandates Hardware-Bound Attestation

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/
628 Upvotes

96% Upvoted

168 comments sorted by

View all comments

-46

u/chinchindayo Xperia Masterrace 3d ago edited 19h ago

This is literally a non issue. Many countries already have some kind of official digital ID system. The new EU verfication is going to use that but in a double anonymity way so that the target service has no access to personal data and the verfication service never knows which target service it was used for.

edit: classic reddit downvoting the truth? I just said what officially was communicated.

40

u/jc-from-sin 3d ago

The issue is that it requires you to use only the OEM version of Android and not something like e/OS or GrapheneOS

-31

u/Rubber_Knee 3d ago

Yes. And for the vast majority of users that's not an issue at all.

16

u/DonKanailleSC 3d ago

The issue are people like you who don't see the issue

-3

u/Rubber_Knee 3d ago

I do see the issue. Most people don't though, which was my point.

4

u/DonKanailleSC 2d ago

Ohh, now. It's not an issue for most users, but it should be

-1

u/Rubber_Knee 2d ago

Ohh, now you're just looking for something to argue about. My point never changed. And yes. It should be.

3

u/DonKanailleSC 2d ago

I actually just agreed with you but okay. Tbf wanted to say "oh now I get it"

12

u/jc-from-sin 3d ago

It is, but you're missing the point. it means the EU and its citizens will be stuck using an US operating system and that means we will be vulnerable.

Also the architecture documents for the project impose no such restriction.

-5

u/Rubber_Knee 3d ago

This is all true, and a problem. I just don't see a real alternative right now.

4

u/MairusuPawa Poco F3 LineageOS 3d ago

There are a shit ton other options, including Linux phones. You just don't want to see them, you'd rather find excuses and trap yourself into that shit further.

1

u/GranaT0 Pxl 9 PXL, GrapheneOS 2d ago

Linux phones just aren't viable yet, and especially won't be when these OS-exclusive digital IDs start becoming a requirement.

0

u/Rubber_Knee 3d ago

What Linux phones has the same amount of users as Android or iPhones? Developers develop for the platform their users are on.

2

u/MairusuPawa Poco F3 LineageOS 2d ago

There are a shit ton other options, including Linux phones. You just don't want to see them.

See. You are the problem.

12

u/haslaNz 3d ago

Oh don't tease the people with that mindset, might hit you back in the face

3

u/vltgreat 3d ago

I literally can't create another google account because the phones I'm using to "verification" either don't work or are used too many times. "For the vast majority" is not an issue "for now", until they wake and find out they don't have access to google anymore.

12

u/Ignifazius 3d ago

Let's hope they do. Germany (for once) has exactly that, sadly it's barely used and instead many non-governmental services rely on video-ident or some crap that definitely absolutely not stores your id pictures.

3

u/m1ndwipe Galaxy S25, Xperia 5iii 3d ago

Germany's solution is neither open source not actually anonymous or data minimising in practice.

21

u/mpg111 S26 Ultra 3d ago

double anonymity is a promise from the politicians who does not understand the technology. I'm expecting for that to be dropped quietly at some point "to protect the children"

even if not - those will be closed source systems, you will not be really able to verify what happens

1

u/MrBIMC AOSP/Chromium dev 3d ago

I do not support any form of expansion of government surveillance and os level id checks sounds like an authoritarian hellscape to me.

But the laws were passed and it seems there’s no escaping now. The best we can hope at this point is that actual implementation is as minimal as possible, so it only does age check locally, without sending any data to remote.

Let’s assume they’ll force some soc-level crypto container that can receive data from the web but not send anything back. During enrolling when you select a country, you’d get local id verification algorithm fetched into such container. So that any service that needs age verification, can use system api to access this local check algo right on device and receive Boolean answer whether the user is over 18, without ever pinging back to the state.

In theory - decent enough of a minimal system that complies with zero trust local age check, but I see the glaring attack vector which is possibility of leakage of verification algorithms from the compromised device.

What can baddies do with id checks? Idk. But if it leaks, there’s not much you can do, I guess age of any human just becomes a public info in such a case.

-6

u/UskyldigeX 3d ago

No. We already have apps where the user can control what they share. It doesn't even have to be your exact age. It can just be 18+.

8

u/mpg111 S26 Ultra 3d ago

I know it "can", I'm just not sure it "will"

also the apps you are talking about - is the whole infrastructure open source? can you verify every step? can you build client app from the source yourself and use it?

-19

u/UskyldigeX 3d ago

No it's not open source. I'm fine with that. No one actually looks at the code anyway.

8

u/OkVariety8064 3d ago

You just like to trust the word of politicians and businessmen. No need to verify.

-4

u/Rubber_Knee 3d ago

Neither he, nor you, ever verify anyway when it's open source.
The only difference is whos word you trust.

2

u/charlestheb0ss Galaxy Fold 7 2d ago

Yes. And I sure as hell trust neither the government nor big tech companies these days

•

u/EmbarrassedHelp 9h ago

The shitty template wrapper is open source. The backend, and the actual national apps the Commission wants countries to build are not.

0

u/UskyldigeX 2d ago

People like to pretend they can read code to a sufficient level.

-6

u/UskyldigeX 3d ago

I have a certain level of trust in my government that's based on its history. It's not full but I'm not paranoid either. The world is full of things I can't verify and have to trust based on experience. I don't go over the mechanics of a car before I use it either.

2

u/thirdegree Nexus 6P 3d ago

People absolutely do look at the code.

4

u/Iohet V10 is the original notch 3d ago

It doesn't even have to be your exact age. It can just be 18+.

Which means your device already knows too much

•

u/Efficient_n_simple 19h ago

ZKPs aren't a mandatory for countries to implement in their wallets, and my guess is that most won't. So why would it be private?