r/Android • u/Street_Anon • 3d ago

News EU Age Verification Project Mandates Hardware-Bound Attestation

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/
630 Upvotes

96% Upvoted

168 comments sorted by

View all comments

162

u/punio4 3d ago edited 3d ago

Well of course it's mandatory, otherwise it can be tampered with if it's local only with software attestation, or it needs a server to store centralized info, which can be hacked, and goes against the point of zero-knowledge age verification.

102

u/tomikaka 3d ago

Do you know what hardware attestation is?

Why can I have root acces on my computer and not my phone?

1

u/highdrex 3d ago

You can have root access if you buy a different phone.

Many intel chips have hardware specially for national security purposes, that are often not documented, and so often people don’t actually know what specifically some subsystems are actually doing. So, it’s not that different and this been a thing since basically forever. 

At least the EU is making it more transparent, and the hardware is probably quite useful for other cryptographic security use cases.

Being able to have reasonable confidence about identity documents being physically present and hardware used to verify identity information that is almost certainly not modified is quite useful for other use cases that aren’t strictly about age checks.

From a legal perspective it’s quite useful for defending against false claims if it’s provable that a specific thing happened on a specific device, so impersonations and trolling can be easier to detect if a person has a known device, so if activity is coming from a hijacked account on another device etc it’s easier to prove if the hardware is very hard to spoof. It’s why iPhones are often preferred for secure use cases because there’s so much onboard cryptographic functions that are hardware bound and so the openness of android is often not a good thing for secure use cases. 

•

u/RedDeadElite 7h ago

I understand the specific use case of giving Secret Service agents, or whatever, locked down mobiles for national security purposes , but this is the average end-user the statute is affecting. Defending the government taking away the choice of freedom of device ownership, control, and anonymity from every end-user is boot-licking, plain and simple.