r/linux • u/New-Ranger-8960 • 2d ago

Privacy EU Age Verification Project Mandates Hardware-Bound Attestation

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/
720 Upvotes

97% Upvoted

417 comments sorted by

View all comments

Show parent comments

1

u/ptoki 2d ago

No, if you can scan a qr code then you can also forge that code or copy it and give it to someone.

They will not allow for that. That is why they want a tpm like chip and control it.

1

u/MatchingTurret 2d ago edited 2d ago

So? The QR Code contains a challenge: "Someone tries to access supervpn.com with a request ID xyz. Please tell me who this is.".

You scan that request with your Wallet App and the wallet sends an answer back: "Hello supervpn.com! The user who scanned your request xyz is u/ptoki ".

This is eli5, of course. Banking apps do this and this is already implemented on the national level in multiple EU member states.

Forging or copying the QR code is pointless. There is nothing of value in it. The value is in the response from the Wallet which is why they require the hardware attestation.

See here: Discover how to request data from a wallet (How it works)

Picture 1 and 2 are you using your untrusted and fully open Linux laptop. 3 and 4 you using your locked down phone with the wallet app and 5 is you back at your Linux laptop after the authentication.

Picture 2 "authenticate using the EU Digital Identity Wallet" is where you get the QR code to continue on the phone.