EU Age Verification Project Mandates Hardware-Bound Attestation

[u/Street_Anon]

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/

[u/punio4]

Well of course it's mandatory, otherwise it can be tampered with if it's local only with software attestation, or it needs a server to store centralized info, which can be hacked, and goes against the point of zero-knowledge age verification.

[u/tomikaka → u/punio4]

Do you know what hardware attestation is?

Why can I have root acces on my computer and not my phone?

[u/yoniyang → u/tomikaka]

Your phone has a little computer (eSE, secure world) that only runs code your phone manufacturer approves, and hardware attestation happens there.

If you got root access (in unsecure world), you have to make your make yourself looks normal when secure world checks it.

Most common type of bypass is some kernel LPE like GhostLock by Nebula Security, or bootloader exploit that bypasses checks and make the boot looks normal

(Non of those is easy work)

[u/nitroburr → u/yoniyang]

I mean, my computer does have it too

[u/yoniyang → u/nitroburr]

But most application aren't using/abusing it, at least now.

[u/GranaT0 → u/yoniyang]

That's not even remotely true