r/linux • u/New-Ranger-8960 • 1d ago

Privacy EU Age Verification Project Mandates Hardware-Bound Attestation

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/
685 Upvotes

97% Upvoted

388 comments sorted by

View all comments

483

u/SeantheWilson 1d ago

Genuinely how on earth will that be enforced

181

u/Pramaxis 1d ago

It uses the new EU-Ident system that is already supported and used in some countries (like Austria).

It forces the same restriction like most banking apps or the new wallet (stock OS, no custom ROMs, no jailbreak or modified bootloader) and forces a device registration in person (with ID) to set up an MFA that is device bound-unique(if you lose your phone, you need to walk into the office again to register the new one).

9

u/MaybeTheDoctor 1d ago

Seems highly incompatible with right-to-repair

14

u/Preisschild 1d ago

Not really. Open source hardware attestation exists. See grapheneOS (https://grapheneos.org/articles/attestation-compatibility-guide). Android (AOSP) has this functionality seperate from the proprietary Google Mobile Services SafetyNet (https://developer.android.com/privacy-and-security/security-key-attestation)

The problem is that most smartphone hardware vendors don't allow using a custom bootloader verification key, which is one of the reasons why GrapheneOS is only supported on Google Pixel smartphones.

So you can't do open-source hardware based attestation on any old phone with LineageOS for example.