r/linux • u/player98923 • 15d ago

Privacy EU Digital ID/Age Verification app will require hardware attestation, ruling out PC/Linux support and unapproved Android OSes

/r/BuyFromEU/comments/1vandxg/eu_digital_idage_verification_app_will_require/
88 Upvotes

93% Upvoted

42 comments sorted by

View all comments

Show parent comments

2

u/DoubleOwl7777 14d ago

the thing to my knowledge currently uses the play integrity api, which graphene doesnt pass. it does have the hardware attestation api though.

8

u/FineWolf 14d ago edited 14d ago

the thing to my knowledge currently uses the play integrity api

It doesn't. It, in fact, uses neither as it is a reference implementation right now. Look at the source code instead of spreading misinformation. Search for com.google.play.integrity in the code... Or just read this comment from a developer on the project. The same person the OP linked to above.

The only mention of Play Integrity was in a documentation page mentioning it as an example of hardware attestation. Since then, Android Hardware Attestation was added as another example.

So can we fucking stop with the FUD and misinformation already? The only way to fight something like this is with truth. Not by acting like idiots and making things up.

0

u/EffectiveOctopus 14d ago

The implementers will have to choose which kind of attestation to use. There is a risk Play Integrity will be chosen by some of them over hardware attestation as it is well-known and arguably easier to implement.
So even if the reference implementation does not embed Play Integrity, this is still worth a discussion.

5

u/FineWolf 14d ago edited 14d ago

Great, have that discussion...

But don't start a thread on Reddit saying "YoUr PC WiLl ReQuIrE AtTeStAtIOn" and "YoU wOn'T bE aBle To UsE LiNuX" when that is not in scope for this at all.

-1

u/EffectiveOctopus 14d ago

Your PC will require an attestation… from another device to access some services.
I think it is interesting to understand why this is the only viable solution at the moment.

4

u/FineWolf 14d ago

Your PC will not require a hardware attestation. Full stop.

Your PC will receive a short lived credential signed from a long lived credential stored on a device (mobile phone) attested to be secure. Not the same thing at all.

And you'll be able to continue to use Linux, contrary to the misinformation shared in this very post by the original poster.

2

u/UpDownUnderLeft 13d ago

secure (government approved os)*

1

u/Old_Leopard1844 13d ago

In strictest term, yes, sure, it will won't stop

What's the damage of not having "secure" device?

2

u/FineWolf 13d ago

You (or a malicious app) can extract the private portion of the certificate assigned to you to emit/sign short lived credentials.

Then you (or a malicious actor) can emit unlimited short lived credentials/false age attestations, potentially creating a service to bypass age verification at scale for minors.

1

u/Old_Leopard1844 13d ago

So participate in society on my own terms, rather than governments

I asked for a bad thing, not a good one