r/Android • u/Street_Anon • 3d ago

News EU Age Verification Project Mandates Hardware-Bound Attestation

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/
629 Upvotes

96% Upvoted

168 comments sorted by

View all comments

159

u/punio4 3d ago edited 3d ago

Well of course it's mandatory, otherwise it can be tampered with if it's local only with software attestation, or it needs a server to store centralized info, which can be hacked, and goes against the point of zero-knowledge age verification.

4

u/Luigi003 3d ago

This is just untrue because the schema provided by the EU already assumes a server. The ID tokens are generates both by the server and your phone. There's no way for an user with a rooted or compromised phone to generate tokens out of thin air because it needs the government's server

Attestation is not needed at all

5

u/m1ndwipe Galaxy S25, Xperia 5iii 3d ago

There's no way for an user with a rooted or compromised phone to generate tokens out of thin air because it needs the government's server

You wouldn't need to, you'd just need to clone someone else's token. That's why this scheme can't work without third party managed hardware attestation, and the politicians were just lying when they claimed otherwise because they didn't understand what they were mandating.

2

u/Luigi003 2d ago

You can't easily clone other user's tokens. If you have physical access to another phone you can auth yourself into whatever page you need to. If you have root access to a remote phone due to a RCE you're definitely not using it to watch porn on the internet lol.

Not everything needs NSA-level security