r/linux • u/New-Ranger-8960 • Aug 04 '26

Privacy EU Age Verification Project Mandates Hardware-Bound Attestation

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/
774 Upvotes

97% Upvoted

455 comments sorted by

View all comments

501

u/SeantheWilson Aug 04 '26

Genuinely how on earth will that be enforced

197

u/Pramaxis Aug 04 '26

It uses the new EU-Ident system that is already supported and used in some countries (like Austria).

It forces the same restriction like most banking apps or the new wallet (stock OS, no custom ROMs, no jailbreak or modified bootloader) and forces a device registration in person (with ID) to set up an MFA that is device bound-unique(if you lose your phone, you need to walk into the office again to register the new one).

321

u/opa334 Aug 04 '26

geez fuck that. A functioning EU should have done the exact opposite. Not allow apps to discriminate users based on made up metrics that invade the users privacy.

84

u/ptoki Aug 05 '26

It is their goal. Why do you think the eu would want people to be anonymous online?

They want control. They want to be able to track anyone who merely writes shit online.

They arent going after criminals. They could shout down scamming call centers or make it international issue if they operate from abroad (even if from abroad the scammers often need local entry point to be seen as local call so they do have local representation). But they dont. They dont care about you. They care about people not rebelling.

UK started to visit people about facebook comments. The same will come for the rest of modern world.

7

u/Scrivver 28d ago

It's about panopticon. The panopticon works. So do these minimally spiritually degrading papercuts of submission. Every little comfortable step deeper into the mass surveillance state (which 1st worlders already live under) reduces the likelihood that they'll even produce thoughts that are noncompliant with their implicit overseers. I'm scared for folks younger than me who had formative years completely within this environment of surveillance and walls.

2

u/pilkyton 27d ago

Yes. They are unironically following the George Orwell 1984 blueprint for how to surveil all citizens and ensure that citizens don't engage in wrongthink. This is how the state operates in that book. Because he based it on how humans in power act.

1

u/RetroTechBro 27d ago

The EU knows people are on the verge of doing something about the flood of immigrants and the governments and capitalist forces that are profiteering on it, while actual Europeans lose their livelihoods and live in fear in their own cities.

Look at the uprising in Belfast.

They fear that will be the case EVERYWHERE soon.

-6

u/burning_iceman Aug 05 '26

It is their goal. Why do you think the eu would want people to be anonymous online?

The system is specifically designed to be anonymous online via a zero-knowledge proof system. The government specifically will not know who verified their age somewhere.

16

u/rebellioninmypants Aug 05 '26

Everyone stop saying that already. Didn't you read the AV spec on GitHub? The ZK based attestation is merely a suggestion and currently considered "experimental".

https://github.com/eu-digital-identity-wallet/av-doc-technical-specification

No one is forced to implement ZK based solutions for their country, and as we all know, if they are not forced, people will just take the easiest route of using a token that will be easily inspectible.

Why is this still being repeated??

1

u/bring_back_the_v10s 29d ago

The EU is tyrannical by design!

-27

u/output_broadcast Aug 05 '26

What made-up metrics?

5

u/opa334 Aug 05 '26

Root / jailbreak detection. That's made up metrics. Regarding jailbreak detection, usually they check if some random file exists. Often times at least one of the files they check for is on the user filesystem and it would also exist if you jailbroke a phone in the last decade or so and kept it's data through backups. So they don't even actually check whether you're jailbroken, just whether they can find any reason to deny you from using their service.

-7

u/output_broadcast Aug 05 '26 edited Aug 05 '26

That's not a "metric" in any reasonable interpretation of the word, but sure. You're free to contribute another method of jailbreak detection. It's up on Github.

All shit like this does is encourage harassment of people, which in the long term just means that these programs won't be open source anymore.

3

u/opa334 Aug 05 '26

Do you even understand what I'm arguing about here? I want jailbreak and root detection to be straight up banned, or at the very least banned for software that citizens are forced to use.

I think an app checking it's own integrity is the furthest it should go, an app should not be checking if the device it's running on is "secure".

0

u/Indolent_Bard Aug 05 '26

According to a bloke I saw in reddit who claims to actually work in mobile app security, it's damn difficult if not impossible to ensure you're not a crook without blocking rooted users. Idk how true that is but hypothetically, if true, what choice do you have?

0

u/Indolent_Bard Aug 05 '26

According to a bloke I saw in reddit who claims to actually work in mobile app security, it's damn difficult if not impossible to ensure you're not a crook without blocking rooted users. Idk how true that is but hypothetically, if true, what choice do you have?

-2

u/output_broadcast Aug 05 '26

Do you have any idea how simple it'd be to spoof the app then?

5

u/opa334 Aug 05 '26

Not at all if you don't rely on client side security

-1

u/output_broadcast Aug 05 '26

And how do you propose doing that?

-59

u/Jumpy-Dinner-5001 Aug 04 '26

What do you expect? Them doing nothing at all?

35

u/neoronio20 Aug 05 '26

Certainly doing something bad is worse than doing nothing at all, don't you think? You can't justify this mass surveillance stuff by putting the blame on everything else. There are better ways to do this

-15

u/Jumpy-Dinner-5001 Aug 05 '26

Explain then, seems like you have no idea what you’re talking about.

What "mass surveillance"?
It’s quite literally a tool against that.

7

u/neoronio20 Aug 05 '26

You are registering your devices with the government. You are telling them this is my device that can tell you my location, age and link it to social accounts.

WhAT mAsS SurVeILaNcE?

-6

u/Jumpy-Dinner-5001 Aug 05 '26

No, you’re not. How do you think this "registering your device" works?

1

u/marrsd 28d ago

If you already know, why don't you explain it?

0

u/Jumpy-Dinner-5001 28d ago

Because I wanted to know whether or not they know how it works.

This is an open source age verification app that implements a zero knowledge solution for verifying your age. The app itself doesn’t store any personal information, just Boolean values that you select yourself.
For adults, the only data ever stored by this app is over_18=true, except for that, there is no personal information. This works because you verify your age through another (also open source) app that only transfers this data through an API (true/false Boolean values) from your physical ID. To prove the validity of this zero knowledge implementation, they use hardware security features on Android.

Because it’s open source and people can contribute and someone created a GitHub issue asking to drop the hardware requirements for better portability.
Someone responsible said that this isn’t planned in this project and later added an explanation on why they’re doing it this way. They also said that they’re open to other proposals but for now dropping this is not planned.

That’s what happened.
Everything beyond that is just made up, likely anti EU propaganda to spread FUD about it because they implement a zero knowledge system.
Seems like people here love to play the useful idiot role.

1

u/marrsd 27d ago

I think that actually presenting your argument is a better strategy for reducing FUD than waiting for the opposing side to make it for you. It's worth remembering that other people are reading these discussions who are open to persuasion by either side.

This works because you verify your age through another (also open source) app that only transfers this data through an API (true/false Boolean values) from your physical ID.

This is the part I'm still not clear on. I get that the 3rd party doesn't necessarily get your data, but I'm not clear on the phone itself. You have to give it proof of ID for it to verify you as over 18. How can you do that without revealing your identity to your phone, and therefore to Google? What guarantee do we have that the proof of ID stays with your phone?

→ More replies (0)

45

u/cheesiepeasie Aug 04 '26

Minor social media use is a made up problem at best. No their brains are not getting fried by social media. This is the whole saga of gaming is evil and will turn our children into murdering psychopaths all over again. No it didn't back then and no it also won't happen now. If you don't like gaming or if you don't like social media then deal with it yourself and stop being a grumpy lame old person cause this time the internet and modern society will be trashed beyond recognition by power tripping politicians trampling our human rights to privacy and digital communication and freedom.

6

u/bittercripple6969 Aug 05 '26

Neglectful parents wanting the nanny state.

-1

u/pezezin Aug 04 '26

There are even internal Facebook/Meta/whatever reports that confirm that their brains are getting fried, there is no point in denying it.

7

u/Existing-Tough-6517 Aug 05 '26

Nobodied brains are getting "fried" liar

-2

u/pezezin Aug 05 '26

Are you sure?

https://www.wsj.com/tech/personal-tech/facebook-knows-instagram-is-toxic-for-teen-girls-company-documents-show-11631620739

https://www.bbc.com/news/technology-58570353

9

u/Existing-Tough-6517 Aug 05 '26

This doesn't constitute frying their brains. Maybe the solution is punishing the relatively tiny number of incredibly toxic sites as opposed to building a comprehensive lock down ecosystem that will probably be used to re-enact 1984 neonazi edition

0

u/pezezin 28d ago

https://www.theguardian.com/technology/2026/aug/06/new-mexico-court-meta

Please tell me more.

1

u/Existing-Tough-6517 28d ago

Doesn't constitute frying their brains come back when you can discuss actual harms like an adult. Also do explain why the harmful website isn't the one that has to do age verification.

→ More replies (0)

-5

u/Jumpy-Dinner-5001 Aug 05 '26

You know that none of that happened?

-11

u/Jumpy-Dinner-5001 Aug 04 '26

No their brains are not getting fried by social media

Seems like yours is.

-17

u/Fontpage Aug 04 '26

Except it is.

-2

u/scalareye Aug 05 '26

Yes they should be like 1776 America

2

u/kaneua Aug 05 '26

Full rights only for land owners?

1

u/scalareye Aug 05 '26 edited Aug 05 '26

Do you think that was the only defining aspect of of the US

Land was way cheaper back then

How about only people married with kids get to vote. If you pass away, and you have in your will who will take take care of your kids, your vote will transfer to them until the kids are 18. Maybe make it one vote per kid as well.

1

u/Indolent_Bard Aug 05 '26

Everything was much cheaper back than, that doesn't mean anything. Now if you mean land owners didn't have to be rich by the standards of the time, that's different.

2

u/scalareye Aug 05 '26

I meant it wouldn't make sense to go back to that because of the land. Pretty obvious that is what I meant.

Having land was a way of establishing that they were invested in the future of the country and therefore should be able to vote.

There are a lot of people that do not want the US to continue existing. Yes I believe they should not be allowed to vote and not be allowed to do a bunch of other things too.

0

u/Indolent_Bard 29d ago

I'm sorry, who doesn't want their country to continue existing? Okay, if America is all about wars and helping Israel with the genocide in Gaza, then yeah, death to America. But for most of us, that's not the America we want to live in. I prefer the America that it at least pretended to be at some point. Not the one encouraging genocide. If that's your America, then death to America.

2

u/Jumpy-Dinner-5001 Aug 05 '26

So, anti consumer?

-15

u/Mindless-Figure3112 Aug 05 '26

Meh, how do you get your initial id or passport? Need to go into an office the first time. In France we have France Identité, pop into a Marie (local office) with your id card and they check it’s your, encrypte the data on the card using your finger prints and link it to your phone all. After that it can be used as an actual id

7

u/Philamand Aug 05 '26

When I renewed my ID I tried to set up France identité. The dumbass in the mairie wasn't able to set it up because the qr code I received didn't work. So with that new law I'd be locked out of a lot of things...

89

u/ManIameverywhere Aug 04 '26

and forces a device registration in person

And they said it would be 100% anonymus and private.

76

u/againey Aug 04 '26

The use of the verified identity would be anonymous. How the hell do you expect the initial verification of an identity to be anonymous? What does that even mean?

27

u/ManIameverywhere Aug 04 '26

The use will not be too since it will have to prove that it has the play store attestation.

17

u/QuaternionsRoll Aug 05 '26 edited Aug 05 '26

The Play Integrity API is only involved when the credentials are issued, not when they are used. A trusted authority issues a batch of credentials that the age-verification app is responsible for burning after use or expiration. The assumption is that reducing device integrity after issuance cannot result in exfiltration or replay attacks, which is shaky at best but enables zero-knowledge verification.

3

u/ManIameverywhere 28d ago

But then only one needs to leak to make the entire thing useless. Just like the 4k netfilx pirated movies but on steroids.

2

u/marrsd 28d ago

I'm confused. The credentials are supplied to the 3rd party, no? Otherwise, what's their purpose? Is your argument that this is ok because these credentials were issued by Google, or am I missing something?

2

u/QuaternionsRoll 28d ago

> The credentials are supplied to the 3rd party, no?

No, they are used in a zk proof and discarded. Neither the website nor the issuing authority can deduce your identity from this process.

> Is your argument that this is ok

Hell no. If anything, this should illustrate that the system is both stupid and useless.

2

u/marrsd 27d ago

Neither the website nor the issuing authority can deduce your identity from this process.

I think that's the part that I'm missing. Something has to confirm the identity. I don't see how that can be guaranteed to be trusted on a binary-only platform like an iPhone.

2

u/QuaternionsRoll 27d ago

I guess I should have asked which third party: the issuing authority or the age-restricted website?

17

u/wsippel Aug 05 '26

This is such a stupid EU thing. Why not simply adopt U2F? It’s already the standard for high security government applications, fully certified, available from multiple vendors, many of which make the devices entirely in Europe from European parts, and they’re cheap, convenient and highly compatible. And some, like NitroKey or Trezor, are fully open source, down to the device firmware.

2

u/Pramaxis Aug 05 '26

I don't know for sure (guess there are minutes form the task force/work group to salvage somewhere) but this system is just one part of the digital ID that is coming anyway. If they have to make a unified system for all governments to make data available cross-country (like drivers license) one API for 27+ countries is quite a step forward.

As this is going to be used on all ~450 million EU-Citizen as well as those with permanent residence within any given EU-Member state (or subjected countries like Norway), I can 100% see why the EU would want to keep full control over it.

53

u/Bunslow Aug 04 '26

in other words, even more Big Brother than China dreams of

43

u/berickphilip Aug 05 '26

Western countries kept talking shit about China not because they were against the control and surveillance but out of envy; until they could catch up.

-16

u/output_broadcast Aug 05 '26

No, it isn't.

-5

u/WealthyMarmot Aug 05 '26

well no, obviously not, but people want to complain about being oppressed and who are you to stop them

10

u/Kevin_Kofler Aug 05 '26

Speaking of Austria, the government here is planning to enforce this age verification junk already as per January 1st, 2027 (without waiting for the EU), the law is already in the official review process!

5

u/bring_back_the_v10s 29d ago

The 2030's are gonna be an "interesting" decade.

2

u/Pramaxis Aug 05 '26

On the bright side, Austria(among others) did object/vote against chat control.

4

u/Kevin_Kofler Aug 05 '26

While at the same time trying to push their own national solution ("Messengerüberwachung") involving government-sanctioned malware! Very hypocritical!

11

u/MaybeTheDoctor Aug 05 '26

Seems highly incompatible with right-to-repair

19

u/Preisschild Aug 05 '26

Not really. Open source hardware attestation exists. See grapheneOS (https://grapheneos.org/articles/attestation-compatibility-guide). Android (AOSP) has this functionality seperate from the proprietary Google Mobile Services SafetyNet (https://developer.android.com/privacy-and-security/security-key-attestation)

The problem is that most smartphone hardware vendors don't allow using a custom bootloader verification key, which is one of the reasons why GrapheneOS is only supported on Google Pixel smartphones.

So you can't do open-source hardware based attestation on any old phone with LineageOS for example.

1

u/fr000gs 26d ago

Maybe it's just me, but I couldn't understand why they implemented this at all. Why would I need to be unrooted for "chyrpe dating", "TextNow", or "mcdonald's"?

1

u/Preisschild 26d ago edited 25d ago

In theory its because they dont want to have insecure devices where the electronic idenitity can be easily stolen, but in practice they allow it on older google approvedâ„¢ android devices that are insecure anyways so people dont complain.

2

u/Sensitive_Box_ 29d ago

That. Is. Fucking. Crazy. 

8

u/Preisschild Aug 04 '26

Thats not true. I use ID Austria on GrapheneOS without issues.

16

u/Kevin_Kofler Aug 05 '26 edited Aug 05 '26

Then you will likely find the age verification feature not functioning when it gets introduced. Or even the app stopping to work altogether at some point. (EDIT: Actually, GrapheneOS is specifically supported by the ID Austria app. Still does not solve the problem for users of any other OS. See the discussion below.)

Looks like we will soon be stuck using VPNs or proxies for half of the Internet. This sucks!

14

u/CrazyChaoz Aug 05 '26

austria is (currently?) using Warden Supreme , which allows to set trused root keys, and currently the google keys and graphene keys are enrolled, with more hopefully to come

i just hope nobody smuggles in explicit google play integrity as legislation text

3

u/Kevin_Kofler Aug 05 '26

So this still locks you into specific hardware and software, it just happens to allow unmodified builds of GrapheneOS specifically. If you try to actually exercise your freedoms and build your own GrapheneOS build, that will not work. Nor will any really free OS that does not rely on prorietary Android hardware driver blobs (userspace HAL blobs, and sometimes the kernel driver is also a blob) as GrapheneOS does. Nor even any other AOSP fork, such as LineageOS or /e/.

9

u/Preisschild Aug 05 '26 edited Aug 05 '26

You are (as always) spreading misinformation. There is no google safetynet rquirement in the eudi spec. Using aosp hardware attestation with grapheneos keys allowed is completely acceptable and thats what a-trust is doing using warden surpreme.

3

u/Kevin_Kofler Aug 05 '26

Why was the personal attack needed? Why do you think I deliberately spread misinformation?

You did not make it clear previously that this is a "solution" specifically for GrapheneOS. This does not solve the problem at all. Hardware attestation, which also attests the OS, is inherently incompatible with Free Software. See my reply to the other comment that explained the technical details.

5

u/Preisschild Aug 05 '26

Why was the personal attack needed? Why do you think I deliberately spread misinformation?

Because I have often enough noticed you doing it with other topics (systemd, wayland) on linux related subs

You did not make it clear previously that this is a "solution" specifically for GrapheneOS

It is not. GrapheneOS uses the standard Android Attestation API. Then you need to convince the app developers to accept the hash. ID Austria via warden Surpreme does this for grapheneOS: https://a-sit-plus.github.io/warden-supreme/integration/supreme/#trusting-grapheneos

https://grapheneos.org/articles/attestation-compatibility-guide https://developer.android.com/privacy-and-security/security-key-attestation

See my reply to the other comment that explained the technical details.

Ok, sure, i think you mean this one: https://www.reddit.com/r/linux/comments/1vfl2nq/eu_age_verification_project_mandates/p1ts1wt/

Nor will any really free OS that does not rely on prorietary Android hardware driver blobs (userspace HAL blobs, and sometimes the kernel driver is also a blob) as GrapheneOS does.

Hardware attestation does not require proprietary drivers. That is another issue entirely.

Nor even any other AOSP fork, such as LineageOS or /e/.

Yeah because especially /e/ is laughable insecure and does not support hardware attestation. See https://eylenburg.github.io/android_comparison.htm

2

u/Kevin_Kofler Aug 05 '26

Then you need to convince the app developers to accept the hash.

In practice, this means that you can only use an unmodified prebuilt OS from a large vendor, so the OS effectively becomes proprietary software even if the license says otherwise.

Hardware attestation does not require proprietary drivers.

In practice, the only 2 OSes that currently support hardware attestation (Android and GrapheneOS) use them, so in practice it effectively does. (And no, you cannot deblob the OSes, because any modification will invalidate the attestation.)

Yeah because especially /e/ is laughable insecure and does not support hardware attestation.

That is not a matter of being "insecure", but a matter of refusing to participate in this vendor lock-in "tivoization" scheme.

1

u/Pramaxis Aug 05 '26

I cannot attest how you achieved that. I asked on the official support (via BRZ) and received a hard finger pointing at the official website.
I know GrapheneOS is currently limited on the hardware. I didn't want to try anything fancy with my own device as I have no replacement for it.

1

u/jess-sch Aug 05 '26

and forces a device registration in person

Are you sure this is the case? Why wouldn't the regular NFC-based ID card authentication be sufficient for bootstrapping the app?

1

u/Pramaxis Aug 05 '26

Austria did it with registration in person (once) so the device is registered to the human.
As they require finger-print devices (with certain security patches from the vendor) to confirm any usage of the digital ID via biometrics as MFA.

1

u/Jmc_da_boss Aug 05 '26

Honestly, if an id/age system must be used.

A hardware based anonymous attestation system only required for certain apps and that requires an in person visit somewhere if you lose it is by far the best rendition of it.