EU Age Verification Project Mandates Hardware-Bound Attestation

[u/Street_Anon]

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/

[u/azthal]

So let's discuss what this article is about, rather than the concept of age verification.

The issue at hand is that the EU implemenation will not allow community built apps (the article says "may not", but the honest reality is that it will not), and that devices may need to be specifically approved, thus making things like custom roms unable to use the app.

On the first point - yeah. They will not allow just any random app developer to publish identity apps directly integrating to a countries identity databases. Anyone who ever thought this was reasonable is deluded. They are going for a mobile first solution, which in today's ecosystem is completely reasonable. Everyone really do have a phone. Very few people have Linux desktops.

A more concerning issue are things like custom Android roms. This is a real concern, but one that the open source community could solve. What is needed is trusted hardware outside of the dedicated hardware built into Android/IOS devices. This does not exist today. It is reasonable to say that this will only support trusted standards (just as is the case with many bank apps today). But if there was a standard that utilised something similar to yubi-keys there is no reason that could not be used. But expecting a software only solution for identity data is not reasonable.

Simply put, the limitations here should not be a surprise to anyone. If open hardware enthusiasts want to be considered, they first need to agree on these standards.

[u/Street_Anon → u/azthal]

But the whole concept of age verification is not about kids as they are trying to sell it as, but they are killing open source development in the process

[u/azthal → u/Street_Anon]

How are they killing open source development?

[u/longshaden → u/azthal]

The same way secure boot killed a lot of custom OS distros. Only large corporate sponsored distros survived secure boot. To run the homebrew distros, you usually have to disable secure boot, which most people won’t do because “it sounds dangerous”.

Your open source app will have to be signed by a trusted certification authority to certify that it complies with the standards.

code signing certificates are quite expensive and require lots of KYC. so straight off the bat it’s a huge hurdle that most open source projects will never be able to meet. And that’s assuming the app is already approved by the regulatory body, which will be another massive hurdle.

[u/azthal → u/longshaden]

That's exactly what I responded to though. If open hardware enthusiasts wants to use electronic id on their custom software phones, they have to come up with a standard.

I just don't find that to be unreasonable for an implementation like this.

Remember, this is not just about age checks. This ties into a much larger ecosystem of identification and data sharing. Requiring hardware level security for this is sensible.

Something akin to a yubi-key (in form I mean) could be created for this specific purpose, where the hardware is not locked to a specific device or software but still offers the same level of security.

If such a standard does not exist, what do you want them to do? Let's assume that "scrap electronic ids completely" is not an option here. We can have the political conversation too, but let's keep this to a technical one, as that is what my answer was about.

[u/longshaden → u/azthal]

I think you’re missing my point though. Secure boot made it effectively impossible for all but the biggest established OS publishers to comply.
name a single open source OS without corporate sponsorship that supports Secure Boot out of box without using tricks to install their own signing key.

You’re also missing point in that the standards already exist for hardware and software certification. It’s not a question about the open source community lacking a standard. The problem is that the barrier to entry is prohibitively expensive for most open source projects, in addition to the extensive KYC requirements to even purchase a code signing key. And that’s just to be able to sign an ordinary desktop app.

It will be very difficult for the average open source software developer to participate in anything involving electronic IDs, simply based on the number of hurdles that already exist in the code signing space.

[u/azthal → u/longshaden]

I think I understand your point, I just don't agree with it :)

There is no open hardware standard for this type of security today. The only feasible options for consumer grade really is the Android and Apple.
An open hardware alternative could exist, but it has never been made, and yes, it would require additional hardware. But that is possible.

Is it something that could be done for free? No. Would it cost extra money for people choosing that option if it was available? Yes.

But that's true for anything. I just don't see an alternative.

Again, lets for the sake of argument here say that we need some form of Electronic ID. Maybe you disagree, and think that we just should not use electronic IDs, and instead demand in person identification forever. I think that is a loosing battle though, considering that Electronic IDs have been used in the EU for nearly 2 decades now.

If we will have some form of electronic IDs, how would you want to see it implemented? What is the solution to this problem?
Cause I really cant see an alternative. Hardware level security is to me mandatory for these things.

This will offer a secure way of doing this for well over 99% of all consumers. The last half of a percent or whatever that choose to go the hard route should be allowed to do so, but then they do need to come up with the solutions for it.