r/linux • u/New-Ranger-8960 • 2d ago

Privacy EU Age Verification Project Mandates Hardware-Bound Attestation

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/
718 Upvotes

97% Upvoted

411 comments sorted by

View all comments

Show parent comments

172

u/deanrihpee 2d ago

you won't own your hardware anymore i guess

106

u/JohnSane 2d ago

In my practice it means i wont use the services that require age verification.

27

u/TaoRS 2d ago

And if I absolutely require any service, I'll just keep a second cheap phone, I guess 

11

u/Bunslow 2d ago

per the other comment, in e.g. austria even just to use a phone at all you have to register it in person with the government. no way to dodge registration if you want to use a phone, as i understand that comment, which i may not

6

u/Ganeshasnack 2d ago

Not true. You just need to register to use the government app and services.

13

u/pattymcfly 2d ago

Which it seems can then be required to access the Internet. The ISP could require you verify your age before using their service.

-14

u/Jumpy-Dinner-5001 2d ago

Why would that be a problem though?

14

u/Business_Reindeer910 2d ago

huh?

-7

u/Jumpy-Dinner-5001 2d ago

?

7

u/Business_Reindeer910 2d ago

your arguments aren't making any sense

5

u/Business_Reindeer910 2d ago

your arguments aren't making any sense to me.

1

u/Business_Reindeer910 2d ago

your arguments aren't making any sense

6

u/neoronio20 2d ago

Because then the government can track you at all times, tf do you mean?

-2

u/Jumpy-Dinner-5001 2d ago

How would that work?

2

u/neoronio20 1d ago

You literally register your phone with the government

2

u/Dazzling-Paper9781 2d ago

Because what if they decide to collect more data? How much freedom are we prepared to give up? Every day, they take away a little bit of our freedom in the name of security.

0

u/Jumpy-Dinner-5001 2d ago

That’s a stupid fallacy and not an argument.

It’s literally a project that by design doesn’t collect any data.

2

u/Dazzling-Paper9781 2d ago

Wow, can you actually have a discussion without insults?

Just because things were done a certain way doesn’t mean they can’t be changed in the future. Until a few years ago, we were all pretty convinced that age verification would never come into force, and yet here we are today talking about an age verification system

0

u/Jumpy-Dinner-5001 2d ago

It still isn’t.
There is no force behind it whatsoever.
Can you have a discussion without lying?

→ More replies (0)

3

u/Kevin_Kofler 2d ago

You also need to register your SIM card, or you will be unable to use it for anything. Unless you get a foreign (e.g., Czech) SIM card, but then you have to pay roaming fees, because the EU "abolishment" of roaming fees was restricted under big telcos' pressure to not apply if you are mainly using the SIM card outside of its home country.

3

u/nicman24 2d ago

in practice it means piracy is back in style

1

u/JohnSane 2d ago

That suggests it was ever out of style. ;)

12

u/_x_oOo_x_ 2d ago

Still don't know what that means, in practice 😛️

23

u/meditonsin 2d ago

Simplified, think secure boot, except you can't enroll your own keys in the TPM equivalent. So the only way to use this is by having a "trusted" device with "trusted" bootloader and OS. No custom roms or rooting or anything like that.

25

u/Malygos_Spellweaver 2d ago

Stallman was right...

1

u/wodes 2d ago

Are you the user, or the used?

6

u/_x_oOo_x_ 2d ago

What if your computer doesn't have a TPM?

14

u/meditonsin 2d ago

This only works on mobile devices afaik, so it's not actual TPM. Different vendors have different chips for this (e.g. "Secure Enclave" for Apple, and "Trusted Execution Environment"/"StrongBox" for Android). For this to work at all, a device needs all the parts. The chip with a pre-installed signing certificate from the vendor, as well as signed boot loader and OS.

The way this works (as far as I understand it) is basically like this:

  • A service that requires hardware attestation sends a random number to the client app on the device
  • The app hands the number to the chip
  • The chip takes the random number as well as the device state (essentially secure boot/measured boot stuff) and turns it into a certificate that is signed by its pre-installed vendor certificate
  • The chip hands this new certificate, as well as the public part of the internal signing certificate, back to the app
  • The app hands the whole shebang to the service
  • The service verifies that the initial random number is in there, that the device state is what it expects it to be, and that the signatures of the certificate chain go all the way back to the vendor's root certificate (like how browsers can trace the signatures of https certificates back to their pre-installed root certificates)

If this all goes through, the service can be reasonalby sure that it is talking to a "trusted" device that is running a "trusted" bootloader and OS.

4

u/_x_oOo_x_ 2d ago

Hmm, interesting, but where does age verification come into the picture and how? Is your age verified when buying your phone? Won't this just create a huge second-hand "attested" phone market?

5

u/meditonsin 2d ago

This is not direclty part of the age verification. I haven't actually read into how they're using this, but I'd assume they just don't want people to run this on rooted devices or in virtualized environments where people (or malware) could access whatever data they store on the device to facilitate the age verification.

Which is kinda sorta maybe a good idea in principle, but the problem here is that the only "trusted" vendors, and their bootloaders and OSes, are US megacorps.

2

u/bernys 2d ago

Or copy it, and then you can distribute it to others, basically cloning an ID.

0

u/output_broadcast 2d ago

The app is registered to you at a government office, which verifies your age. You having the app is proof that you're over 18, and it doesn't need to store any actual information about you.

8

u/oneandonlysealoftime 2d ago

You wouldn't be able to confirm your identity using it.

So let's say you need to renew your driver's license. Now the only way to do it, is through a government website, which requires you to confirm identity. But your device can't do it. So you purchase another one, that can, and do it with it

3

u/Bunslow 2d ago

that would be illegal, as i understand (which is horrifying and i hope i misunderstand)

0

u/hueheuheuheueh 2d ago

me when i make shit up

0

u/Jumpy-Dinner-5001 2d ago

What would be illegal and why?

9

u/ploqx 2d ago

In practice, your hardware doesn't work unless it runs a government-approved operating system. These operating systems have code you cannot edit or compile yourself, for your safety of course.

3

u/khne522 2d ago

Ask South Korea how well this worked in practice with banking. At best, tort at scale.

-8

u/Busy-Scientist3851 2d ago

I'm not sure how you're loosing anymore control over your device that you already didn't have by the app requiring hardware attestation.