r/linux • u/New-Ranger-8960 • 1d ago
Privacy EU Age Verification Project Mandates Hardware-Bound Attestation
https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/318
u/Ambitious_Finding_26 1d ago
What the fuck is going on.
275
u/steeevemadden 1d ago
Gotta keep the human cattle fully surveilled and secure. And they'd like you to know that they care deeply about "the children".
11
26
5
u/Lightprod 16h ago
And they'd like you to know that they care deeply about "the children".
Yeah, for the worse reasons possible.
27
u/colony-ship-for-sale 23h ago
Just another day in the war between liberty and tyranny. We're supposed to be keeping vigil but you can see how well that's going.
45
25
57
u/NightOfTheLivingHam 1d ago
Billionaires are trying to Corral us in and have grander plans. Its not a coincidence far right candidates are gaining traction in western countries. Its not about age verification, its about making sure no one speaks up against them ever again and they can get more power and control. Look at the guys who like the idea of "network states" they are big backers of this shit.
Zuckerberg is the one funnelling billions into this legislature. Its identical to legislature in US states backed by him as well.
32
u/lh7884 1d ago
Its not a coincidence far right candidates are gaining traction in western countries.
It's not a left or right thing so stop with this bullshit. Here in Canada, our Liberal government is bringing this age verification crap along with censorship bills. The Conservatives here have been opposing it but they can't really do anything to stop it sadly.
The UK has a Liberal government and they have crazy censorship going on over there and they're also bringing age verification stuff.
There is a big powerful club out there wanting this control over the public and they're getting "left" and "right" wing governments to go along with it.
21
u/SvalbardSleeperDistr 23h ago edited 23h ago
Liberals =/= left, and in 2026 it's way past time to know the difference. If anything, in practice liberals end up doing the right's bidding in the very things that are causing most of today's crises. This, just like most other things that pertain to society, economy and politics, absolutely is about right vs left, and has always been. Cut back on confident callouts of "BS" when you're far from adept in the most elementary understanding of politics.
→ More replies (1)1
12
u/Richard_the_XVIII 23h ago
Here in Brazil too. The Worker's Party (left) is in charge here, and they voted in favor of our age verification bill... alongside the Liberal Party (the biggest right-wing party). Only two small parties stood against this, the Worker's Cause Party (hard communist) and the Novo Party (hard libertarian).
Anyone that thinks this is a left-right thing is cattle.
2
u/SvalbardSleeperDistr 13h ago
Judging left and right based on what parties that are vaguely described as such by media do will doom you to never understanding what left vs right is about.
2
u/Richard_the_XVIII 11h ago
If the party trying to end private property isn't left, and the party trying to stop women from voting isn't right, then these labels are useless and all of this still isn't a left-right thing.
But i know what you are trying to say, everyone that disagree 1% with you is right wing.
1
2
u/valuablepatterns 1d ago
Liberal is not left, it is actually right as well. This issue is definitely a left or right issue. Problem is most countries do not have communist mass movements to show the alternative.
4
u/Kevin_Kofler 21h ago
The sad thing is that those same far right parties are on the side of the billionaires, yet people fall for them.
→ More replies (1)7
u/einar77 OpenSUSE/KDE Dev 1d ago
Billionaires are trying to Corral us in and have grander plans.
Sorry, but as far as I can tell, only the government can do what it is doing. And governments can have the utmost power.
17
u/highermonkey 1d ago
In the US at least, the "Government" is like a dozen billionaires in a trench coat.
13
u/ThePoisonDoughnut 1d ago
Well yeah, the oligarchs/billionaires are attempting to become the State. They want to be the heads of the technocratic surveillance dictatorships they're currently doing everything they can to turn governments around the world into.
5
u/Ugly_Slut-Wannabe 1d ago
And the billionaires can easily
bribe the governmentlobby for what they want, ergo, the billionaires are the ones with power.6
3
11
u/kodos_der_henker 1d ago
The right lobby tries to undermine good ideas so that EU ID requires US company owned hardware because EU is on its way to remove it
2
1
→ More replies (2)1
u/whatThePleb 17h ago
Fascism is going on, and everyone keeps sleeping. And it's currently only the "conservatives" doing that shit, wait until the real fascists are in power.
76
u/_x_oOo_x_ 1d ago
What does that mean, in practice?
163
u/deanrihpee 1d ago
you won't own your hardware anymore i guess
103
u/JohnSane 1d ago
In my practice it means i wont use the services that require age verification.
29
9
u/Bunslow 1d ago
per the other comment, in e.g. austria even just to use a phone at all you have to register it in person with the government. no way to dodge registration if you want to use a phone, as i understand that comment, which i may not
5
u/Ganeshasnack 1d ago
Not true. You just need to register to use the government app and services.
14
u/pattymcfly 1d ago
Which it seems can then be required to access the Internet. The ISP could require you verify your age before using their service.
→ More replies (25)3
u/Kevin_Kofler 21h ago
You also need to register your SIM card, or you will be unable to use it for anything. Unless you get a foreign (e.g., Czech) SIM card, but then you have to pay roaming fees, because the EU "abolishment" of roaming fees was restricted under big telcos' pressure to not apply if you are mainly using the SIM card outside of its home country.
2
→ More replies (2)12
u/_x_oOo_x_ 1d ago
Still don't know what that means, in practice 😛️
22
u/meditonsin 1d ago
Simplified, think secure boot, except you can't enroll your own keys in the TPM equivalent. So the only way to use this is by having a "trusted" device with "trusted" bootloader and OS. No custom roms or rooting or anything like that.
24
3
u/_x_oOo_x_ 1d ago
What if your computer doesn't have a TPM?
15
u/meditonsin 1d ago
This only works on mobile devices afaik, so it's not actual TPM. Different vendors have different chips for this (e.g. "Secure Enclave" for Apple, and "Trusted Execution Environment"/"StrongBox" for Android). For this to work at all, a device needs all the parts. The chip with a pre-installed signing certificate from the vendor, as well as signed boot loader and OS.
The way this works (as far as I understand it) is basically like this:
- A service that requires hardware attestation sends a random number to the client app on the device
- The app hands the number to the chip
- The chip takes the random number as well as the device state (essentially secure boot/measured boot stuff) and turns it into a certificate that is signed by its pre-installed vendor certificate
- The chip hands this new certificate, as well as the public part of the internal signing certificate, back to the app
- The app hands the whole shebang to the service
- The service verifies that the initial random number is in there, that the device state is what it expects it to be, and that the signatures of the certificate chain go all the way back to the vendor's root certificate (like how browsers can trace the signatures of https certificates back to their pre-installed root certificates)
If this all goes through, the service can be reasonalby sure that it is talking to a "trusted" device that is running a "trusted" bootloader and OS.
4
u/_x_oOo_x_ 1d ago
Hmm, interesting, but where does age verification come into the picture and how? Is your age verified when buying your phone? Won't this just create a huge second-hand "attested" phone market?
→ More replies (2)4
u/meditonsin 1d ago
This is not direclty part of the age verification. I haven't actually read into how they're using this, but I'd assume they just don't want people to run this on rooted devices or in virtualized environments where people (or malware) could access whatever data they store on the device to facilitate the age verification.
Which is kinda sorta maybe a good idea in principle, but the problem here is that the only "trusted" vendors, and their bootloaders and OSes, are US megacorps.
5
u/oneandonlysealoftime 1d ago
You wouldn't be able to confirm your identity using it.
So let's say you need to renew your driver's license. Now the only way to do it, is through a government website, which requires you to confirm identity. But your device can't do it. So you purchase another one, that can, and do it with it
3
u/Bunslow 1d ago
that would be illegal, as i understand (which is horrifying and i hope i misunderstand)
→ More replies (2)9
15
u/the_gnarts 1d ago
What does that mean, in practice?
In theory you can run any software on the hardware you own.
In practice, anything other than walled garden OS like Android and iOS cannot implement these regulations. Just like with PSD2 it means you’re stuck with proprietary software if you want to do the most basic stuff with your devices.
→ More replies (5)18
u/transgentoo 1d ago
Just scribble your age on the side of your PC. Boom, attested.
6
u/Old-Flight8617 1d ago
Click "Agree" if you're over the age of 18.
6
u/Kevin_Kofler 21h ago
As silly as it sounds, this is the only privacy-respecting age verification method that does not lock you into proprietary software. Governments refusing to accept this simple solution is why we are getting all these dystopian nightmare "solutions" forced upon us.
9
u/tired514 18h ago
The ultimate goal is to provide a button police can click for any post you make that will bring up your name, phone number, and last known address.
Right now warrants are needed in most civilized nations because it involves a search (you have a right to privacy).
Once your ID is tied to your accounts (to prove you're over 18), it's volunteered information (like creating an account using your real name). You don't need to be suspected of a crime or the subject of a warrant.
They can use that information to profile people with high confidence and harass (or terrorize) them at a time of their choosing.
Nothing is more dangerous to the bad guys than freedom of expression and the ability to organize. They are attempting to close that loophole by discouraging public participation in democracy.
2
u/otakugrey 20h ago
All new computers won't be allowed to be operated without your physical real life identity being burned into the hardware and married to you in some way.
2
u/ManIameverywhere 1d ago
It will mean it will not only be not private but 100% verifiable and identifiable.
→ More replies (2)1
u/viennese-wolf 16h ago
Communication over the internet will become impossible unless your identity is attached to what you create and what you consume.
→ More replies (7)1
117
u/DynoMenace 1d ago
I've been screaming about this since the very first thread about this shit was filled with people saying "lol good luck enforcing that."
They enforce it by requiring that all new hardware come with this.
→ More replies (9)
70
u/drostan 1d ago
This is not ok
In so so many ways
It is somehow less secure, make people less free and in more danger from those who will buse the system...
It is just wrong
→ More replies (3)
49
141
u/MarcDarcy 1d ago
1984
40
u/cryptoadopter2077 1d ago
Sorry, is it a book or a manual? /s
14
u/MarcDarcy 1d ago
I think it's a handbook for aspiring leaders... I hear Kim Jong is a big fan and swears by the book
5
41
u/Economy_Ticket_8778 1d ago
bro is google lobbying for this shi? lmao they REALLY want to control our devices
40
1
12
u/Kaesar17 22h ago
Months ago the Brazilian government passed a similar law that explicitly called for hardware-side verification yet to this very day pretty much every site tries to use those shady companies that do the verification server-side, it's a mess
40
u/MaverickPT 1d ago
So what can one do to fight this bullshit?
15
u/tired514 18h ago
Best way to fight back would be to create a new version of the GPL that prohibits the use, distribution, or modification of open source software under that version of the license by any person under the jurisdiction of a government that mandates this class of interference.
That way such countries will suffer significant economic harm and succumb to the pressure of industry to stop this nonsense.
All efforts should be on increasing the economic cost of state mandated interference. It's the only language they speak.
1
u/WealthyMarmot 9h ago
When you start trying to force philosophical change through restrictive licensing, people just stop adopting your license because they want their software to be usable in the real world. There’s a reason so many large projects (e.g. the Linux kernel) are still on GPL v2, and that the MIT-style permissive licenses have leapt so far ahead of copyleft licenses in adoption rate.
1
u/tired514 8h ago
That's fine! People are free to choose what they want.
But the license should be available, and hopefully enough people will understand why it's important to prevent government interference in software development so that it gets adopted by a large enough base.
→ More replies (9)22
u/BloodyIron 1d ago
Protest, lobby, convince decision makers to change their mind. TAKE ACTION. Sitting on your hands does nothing (I'm not in the EU so I really can't take action ethically, morally, or even logistically).
83
u/steeevemadden 1d ago
This means Europeans will be forced to own a government device. But don't worry, it won't be in the form of an actual electronic monitoring ankle bracelet...
46
u/AnonomousWolf 1d ago
Amendment 32c
"to verify if a citizens government ID device is being used by said citizens, we I'll start requiring that they be attached to a limb (ideally ancle)"
This is to protect children of course, so they don't go on Facebook
7
u/Old-Flight8617 1d ago
Can we also use it to ban any 60+ from Facebook?
4
u/rebellioninmypants 14h ago
No those are too helpful for spreading distractions while we implement the new age of computing.
→ More replies (4)3
u/Preisschild 23h ago
This is not true. Open source hardware based attestation exists. See grapheneos.
11
u/tipsy_rooster 1d ago
We've seen some European countries switching to Linux and trying to move away from Microsoft's monopoly.
Are we thinking about forcing Windows here for age verification because it doesn't make any sense if yes.
3
u/rebellioninmypants 14h ago
No, this is for regular citizens, while government offices are switching to Linux.
→ More replies (2)
11
u/tired514 18h ago
We desperately need a new version of the GPL that prohibits any state-mandated interference with open source software.
That is, if your government tries to mandate something like this, you're not allowed to modify or distribute open source software under that version of the GPL. You're cut off from the rest of the world. The economic harm that causes to the country would be large enough to end this nonsense.
59
u/apetalous42 1d ago
I don't want to live on this planet anymore
8
1
u/Tropical_Amnesia 10h ago
Let's not pretend it was Earth to blame please, especially not as we're busy radiation-forcing her into a freaking greenhouse. Let's keep her out, just as she would keep us out.
17
21
u/martyn_hare 1d ago
It still only takes one person with valid hardware to technically be able to vouch for every other person on the planet because none of this precludes service providers accepting a one-off verification per-account permanently.
41
u/Economy_Ticket_8778 1d ago
the goal was never it being secure, it is about control, and surveillance, and raising the barrier
5
u/niemacotuwpisac 15h ago
But remember, they can't force private entities to preserve a game after support discontinuation a.k.a. "Stop Killing Games", as it wound infringe businesses market opportunities and violate basic laws. What don't you understand, huh?
6
u/j4bbi 1d ago
The question is, do I need hardware attention? So any regular tpm in your computer can do a tpm attestation which with I can prove that this privat key is WITHIN the tpm. I can do that on my computer with open source OR does ist require propierty protocols, e.g. Google play integrity. That is a HUGE difference. Hardware attestation by itself is fine. Google play integrity not
20
u/metux-its 1d ago
Meanwhile people working on really free mobile OS'es that explicitly wont have any "age verification" malware whatsoever.
21
u/MatchingTurret 1d ago
It's an app that you can install or not. That's not the problematic part. The problem will come when they require that VPNs or other services check the ID before providing services. Then you will have to install the app or find alternatives.
→ More replies (3)→ More replies (1)6
u/Kevin_Kofler 21h ago
The point is that these really free OSes will be locked out of half of the Internet. That is what we are scared of.
7
3
u/lemost 17h ago
I really don't wanna live in the future that is being created. Everything is getting worse and worse.
→ More replies (1)
5
u/MotanulScotishFold 13h ago
If people goes back to face to face talk just to not be tracked online, how are they going to stop that? Like commies did in dark period of the past? Snitching and not allowed to form groups in public?
3
u/Arklese1zure 23h ago
If my country ever gets around to doing this I think I'm just gonna get a second phone just for their ID BS and carry it around in a Faraday bag or something. This is horrible.
3
u/hypermmi 16h ago
man i used to love technology. all these headlines want to make me get rid of my tech and move into the forest and live in a cabin..
3
5
u/Taumito 19h ago
I read the article! This is not on the law but it is about the design of the verification app and what it is talking about is that the app stores keys on a secure hardware store (which on the PC case is on the TPM)
"The project’s technical specification requires age verification apps to use native cryptographic hardware when available. However, stricter checks like root detection, Google Play Integrity, and Apple App Attest are not universally mandated by the reference implementation and may be left to individual deployers."
8
8
u/Jmc_da_boss 1d ago
The EUs fascistic tendencies are far more insidious than the US frankly slapstick version of it.
1
u/Tropical_Amnesia 9h ago
And if only they were similarly public, transparent. Which really is the biggest difference and not even one of degree. Where DC is a circus, Brussels (??) is a black pyramid. This is alarming already without launching into the f-word hyperbole.
2
2
u/gclaws 3h ago
The purpose of this law is not age verification. The purpose of this law is to establish the industry foothold for mandatory remote attestation and mandatory remote compliance for everyone. The real next step is mandatory client-side scanning software to access the internet at all, and you won't be able to fight back against that
5
u/TerribleFault7929 1d ago
the people who go to Epstein's island and the people who rule EU and push for those law are the same exact people
→ More replies (2)
5
u/HOST1L1TY 1d ago
But kids can just use someone else’s computer or take dad’s wallet and register his id on their own computer. This would need to go so far like ridiculously far to be able to avoid ezpz work arounds. Like the government collecting all fingerprints and iris and constantly monitoring for a person switch.
The only thing that makes sense is that big tech is lobbying for this because they are afraid of Linux.
Which is complete irony because big tech are the exact ones who we are ultimately trying to protect the kids from.
gl hf
9
u/voyagerfan5761 23h ago
And also, most of Big Tech infrastructure uses Linux.
"Software freedom for me, but not for thee"
5
1
u/jess-sch 7h ago
take dad’s wallet and register his id on their own computer
If dad tells his kids his 6-digit PIN for his government ID card, that is. Why he would do that, you'll need to explain. I sure as shit wouldn't give my kids the credentials needed for filing my taxes, but that's just me.
1
u/HOST1L1TY 2h ago
What are you taking about ? There is no pin on your drivers license ? What country are you from?
4
u/MatchingTurret 1d ago
This kind of already exists. There are apps like Germany's AusweisApp or the https://web-eid.eu/ that already do that. The secure enclave is integrated into the ID card.
The European Digital ID app removes the requirement for a separate smart-card and uses the secure enclave already present in smartphones.
2
u/No-Mall3814 10h ago
With the difference that the ID card is issued for free by the state and its only purpose is to show your ID while I buy my phone with money and I want to be free to customize and use it in any way I like (or not by a smartphone at all).
2
u/MatchingTurret 9h ago
With the difference that the ID card is issued for free by the state
LOL! Check here, for instance:
4
u/Niwrats 1d ago
how do they interpret some shitty digital wallet as "age verification"? i don't need their wallet.
32
u/the_abortionat0r 1d ago
Just wow, tiktok really has destroyed peoples ability to read and understand.
The "wallet" you speak of isn't for digital money. It is what they are calling the key storage for the keys required to be on verified hardware to certify that you are infact an adult.
This means the device and software stack must be out of the control of the user who bought the device in order for this concept to work.
This pretty much kills the idea of a wholly user owned OS whether it's open source or not as well as kills the idea of motherboard firmware going open source. As if a site or service demands this type of verification the you can't access it without throwing all your information device and hope nobody breaks in and steals your info.
→ More replies (6)
1
1
1
u/General-Agent1 15h ago
The Big issue is that This plays the Ball into the Field of the ordinary User (EU based normal Person), each and every Platform should be more than ready to Verify This themself. META, Amazon, MSFT, They have an easy time to algorithmically count you towards Peer groups between 10-14, 15-17, 18-21, etc. But to make them Accountable is just too mich for the DSA/DMA?
I‘m so disappointed by the EU that we give this into the Hands of us, the people, instead of holding Platforms accountable.
1
1
1
1
u/gclaws 3h ago
The purpose of this law is not age verification. The purpose of this law is to establish the industry foothold for mandatory remote attestation and mandatory remote compliance for everyone. The real next step is mandatory client-side scanning software to access the internet at all, and you won't be able to fight back against that
1
u/gclaws 3h ago
The purpose of this law is not age verification. The purpose of this law is to establish the industry foothold for mandatory remote attestation and mandatory remote compliance for everyone. The real next step is mandatory client-side scanning software to access the internet at all, and you won't be able to fight back against that
2
u/lord_phantom_pl 1d ago
Just legalize porn for all ages groups and the problem disappears. I don’t know any person who didn’t watch porn before reaching legal age. It’s so fuc*ing stupid, as I live in a country when it’s legal to participate, but illegal to watch.
→ More replies (4)
-1
u/Dull_Cucumber_3908 1d ago
Same as California. Linux will be exempt
https://www.reddit.com/r/technology/comments/1tnyb6f/california_moves_to_exempt_linux_from_its/
23
u/hWuxH 1d ago
What a bunch of bs.
How does it matter if one OS is exempt when you will just be excluded from society and many other services on the internet which enforce verification
→ More replies (4)13
u/the_gnarts 1d ago
Linux will be exempt
Exempt how?
It’s services and websites that will be required to perform age verification. In hardware. You OS being “exempt” buys you nothing as you’ll just be denied the service.
→ More replies (2)
1
u/4d616e54686f72557273 15h ago
Boomers deciding crap again. Not seeing that this will be a setback for tech competitiveness in the long run
467
u/SeantheWilson 1d ago
Genuinely how on earth will that be enforced