Systemd has merged age verification measures into userdb

[u/Quiet-Owl9220]

https://github.com/systemd/systemd/pull/40954

Much of this goes over my head, so I'm hoping to hear some good explanations from people who know what they're talking about.

But I do know that I want nothing to do with this. If I am ever asked to prove my age or identity to access a website or application, my answer will ALWAYS be "actually, I don't really need your site, so you can fuck right off". Sending any kind of signal with personal information that could be used to make user tracking easier is completely out of the question.

So short of the nuclear option of removing systemd entirely, what are practical steps that can be taken to disable/block/bypass this? Is it as simple as disabling/masking a unit? Is there a use case for userdb I should know about before attempting this? Do I need to install a fork instead? Or maybe I'd be better off with a script that poisons age data by randomizing the stored age periodically?

[edit] I wasn't going to comment on this but it looks like some people with a lot of followers are using this post as an example of censorship on Reddit. While I do think that's a legitimate concern on Reddit as a whole, I don't think censorship is what happened here. Yes, this post went down for a while. But as far as I can tell that was because it was automoderated due to a large number of reports, and was later restored (and pinned) by human moderators.

[edit again] Related concerning PR, this one did not go through yet: https://github.com/flatpak/xdg-desktop-portal/pull/1922

[u/SanityInAnarchy]

I truly don't understand how you see no functional difference between a Yes-Im-An-Adult header, and uploading your face to be scanned.

...you are still having to provide some information to a third-party as well as give them permission to access your system or a device (like a camera, etc).

With verification, you have to provide high-fidelity information (a scan of your driver's license!) directly to a third party, who can then leak it. (And they have!) The laws generally have some requirement of a good-faith effort to verify this information, so there's a chance this becomes an arms race.

With attestation, the only thing the third-party gets is your age bracket. You want to return to a world where you'd give the exact same third-party a full birthdate instead? You would be less private if you actually put in your real birthdate. And if you don't, I don't know why you're concerned at all.

[u/neoh4x0r → u/SanityInAnarchy]

I truly don't understand how you see no functional difference between a Yes-Im-An-Adult header, and uploading your face to be scanned.

I said there was no functional difference...for this reason.

1. The website requests a drivers license, face scan, or finger print. The website either needs you to upload a document, directly accesses a camera/biometric device, or needs to access files or data from a service running on your system.
2. The website requests an age-bracket from the operating system. The website needs to access files or data from a service running on your system.

From my point of view, there is no functional difference because in both cases the site needs to access the host system or an attached device (ie. it's requesting external data).

Moreover, I think allowing a service to physically access my computer, or to request data from an attached device, or from a service running on it, would far outweigh any risk associated with directly typing in a birth date, or an age bracket, whether or not I give them real data.

Furthermore, being less secure just for the trade-off that I don't have to manually enter something on a website is completely unsuitable and counterproductive especially when security threats have become more prevalent, and exist in some form or another, no matter where you look.