Unless their governments start issuing Android devices to all of their citizens, I don't understand how they can require use of this app for anything official.
So many people advocating for this in HN and elsewhere when it's so clearly a draconian slippery slope for invasive surveillance and choice restriction. After these things get implemented people pretend it was always like this.
We don't need the governments to mass surveil us to protect us. We need them to sort the economy and stop invading countries and being deferential to corporate interests instead of the people they represent.
It's such an obvious push that If you don't want to see it, it makes me think you're shielding yourself to avoid contending with the reality: These politicians and govs all around, including the countries you claim "work" are absolutely power hungry and beholden to interests other than yours and will push for as much total surveillance as they can, including as much curtailment of freedoms as they can.
Obviously that won't mean elites will actually face justice or crimes will actually be solved because more surveillance is not accompanied with more government transparency, quite the opposite and bigger and more powerful burocracies, with more authoritarianism, allow for easy hidden exceptions that you can't question.
It's nothing new. Corruption is common. It's just mediocre to see "hackers" pushing for it just because the government and corporations tell them to, because foreign country bad, bad social media influences kids, drugs, word-ism, etc.
The operating system was licensed by Google
The app was downloaded from the Play Store (thus requiring a Google account)
Device security checks have passed
While there is value to verify device security,this strongly ties the app to many Google properties and services,because those checks won't pass on an aftermarket Android OS
I would like to strongly urge to abandon this plan.
Requiring a dependency on American tech giants for age verification
further deepens the EU's dependency on America and the USA's
control over the internet.
Especially in the current political climate I hope I do not have
to explain how undesirable and dangerous that is.
As a resident of the aforementioned political climate, I find their concerns to be reasonable.
There are a number of comments in that same thread that indicate a mandate to utilize Google services may run afoul of EU member nations' integrity and privacy laws.
What an absolute clown show - the EU fines Google and Apple for being monopolistic and abusing market power and then proceed to implement apps like these that can only be used on American operating systems.
Essentially, the core user journey is a privacy preserving "over 18" check. I suppose this prevents under 18's from accessing porn, in the same way that most blocking technologies impose an expense on everyone but fail to block tech-savvy children.
Doesn't seem like it could ever stop someone with a bittorrent client, unless you have to attest you are over 18 to even use bittorrent.
> Essentially, the core user journey is a privacy preserving "over 18" check.
You can not check the age without breaking the privacy, technically it is Not possible; this is like a religious faith exercise, not science.
What one read in the specification is, firstly you install an official software in your device, the device becomes identified "as you" the first time you verify your ID and receive your unique internet ID hash, linked to your personal data at the identifier platform.
In addition, your unique internet ID hash will become you, and each time a Non-porn-related platform ask for it, you will leave track of who are you -as internet ID- to the platform (finger printing), and also what you visit to the identifier platform.
Yeah, I said Non-porn-related platform, literally, because what we are reading here is about an Internet digital ID hash for each EU citizen,
Lets be clear, if it were to protect the children from porn, it would say "verify with the personal internet ID only for porn sites", in company with all the adjectives derived from porn, exclusively, with specificity, nothing more.
But what we are seeing here about this matter is deliberately open to interpretation, they say "platform that can be considered to be accessible to minors"... boom, What does this mean, News for adults? Criticise a corrupt government for adults? In my village this is called a back door trojan, because when they want they redact the directives, laws, with precision.
Anyway, I invite the reader to take a look to the Digital ID directive on its own,
After this, they only have to define progressively, frog cooking time, and increase the affected Internet platforms with obligatory identification, and then we will think that the Great Chinese Firewall was a children game compared with this.
The "it's to protect the children" political tactic to break privacy is quite old. In addition we should remember the other EU law about breaking the encryptions.
My humble opinion.
PS: Ironically no more of two months ago I was saying that as I was European I have freedom and I didn't need a tooling for circumvent something like the Russian and Chinese censure. Oh my... If I were know this, I was absolutely blind about what someones try to cook.
I use GrapheneOS as a daily driver and I absolutely love it. It should be the default. There's already one app I use that must do something similar and absolutely just won't run on it, so I have an entirely separate phone running stock Android just for that one app. Still worth the hassle.
Glad I don't live in a place where all this madness is taking root, but still, the trend itself sucks.
Without getting into the ideological weeds too much, is there a solid technical reason for this? Like if this verification wasn’t in place, could I just alter the source code or binary to always return “yes I’m 18” (or whatever) and completely subvert the intent of this tool? If so, is there a straightforward way to prevent this without involving Google?
No evidence is given that they won't implement non-Google remote attestation solutions like https://attestation.app/about
Indeed, the bug links to another bug where the author says that it isn't restricted to Play Services remote attestation and recently followed up with a documentation update making that clear. https://github.com/eu-digital-identity-wallet/eudi-app-andro...
We shouldn't need Age Verification checks for adults in the first place.
Create a better, standardized, open-source parental control tool that is installed by default on all types of device that can connect to the web.
The internet aspect of the parental control should be a "Per Whitelist" system rather than Blacklisting. The parents should be the ones to decide which domains are Whitelisted for their kids, and government bodies could contribute with curated lists to help establish a base.
Yes, there would be some gray area sites like search engine image search, or social media sites like Twitter that can allow you to stumble into pornography, and that is why these devices that have the software turned ON, should send a token through the browser saying "Parental Control". It would be easier for websites to implement a blanket block of certain aspects of their site than expect them to implement whole ID checks systems and security to make sure that no leaks occur (look at the TEA app) like the UK is expecting everyone to do.
Also, I'm for teenagers (not little children) having access to pornography. I was once a teenager, every adult was, and we know that it's a natural thing to masturbate which includes the consumption of pornography for most in some way. Repressing their desires, their sexuality, and making this private aspect of their life difficult isn't the way. Yes, yes, there is nuance to it, (very hardcore/addiction/etc) but it should be up to the parents to decide with given tools if they trust their kid to consume such a thing.
As for the tool itself. Of course we have parental tools, but they can be pretty garbage, their all different, they're out of the way, and I understand that many people simply don't know how to operate them. That's why I believe that creating a standardized open-source project that multiple governments can directly contribute to and advertise for parents is the way, because at the end of the day, it should be up to the parents to decide these things, and for the government to facility that choice.
Obviously, besides the internet aspect, the tool should have all the bells and whistles that you'd expect from one, but that's not the topic.
EDIT: And yes, some children would find a way, just like they're doing now for the currently implemented ID checks. It's not lost of me that VPNs with free plans suddenly exploded in 4 digits % worth of downloads. A lot of those are tiny people who are smart enough. Or using an app like a game to trick Facial Recognition software.
I am not sure if I am more disturbed by the user journey they want to introduce for accessing websites or the fact that a private company (american, chinese, I don't care) has to become the gatekeeper to let me in.
Lol. People put way too much trust in governments.
If it's not unbelievably obvious, there's an entire class of people flying private jets to "world summits" where the transcripts aren't disclosed. What do you think is going on? Use your brain.
The war on the free internet is accelerating. Without real push-back to these dystopian laws and consequences for the people proposing and lobbying for them, you'll miss what will ultimately end up being a temporary anomaly of mostly unrestrained free flow of information. It's not an hypothetical scenario or something that will develop down the line, it's happening today, worldwide.
The European union never ceases to amaze me. Whatever happened to becoming less dependent on American corporations?
They flip flop on this stuff at least once a month, and the most annoying part is that they always herald everything they do as some new epoch-defining initiative only to quietly forget about it and do the opposite a few months later.
If nation states are dogs, then EU is the chihuahua: loud, proud and extremely ineffective.
"age verification app," is such a phony pretext. They know that android fragmentation and the lack of consistent verifiable hardware is what prevents govts from implementing a punitive digital ID that is sufficient to punish and fine people using western standards of evidence and legal defense.
these people are monsters. don't help them, and don't be complicit. working on digital ID tech, and even disclosing vulns in it is like helping Hollerith make faster and more efficient punch cards.
67 comments
[ 3.6 ms ] story [ 61.5 ms ] threadUnless their governments start issuing Android devices to all of their citizens, I don't understand how they can require use of this app for anything official.
We don't need the governments to mass surveil us to protect us. We need them to sort the economy and stop invading countries and being deferential to corporate interests instead of the people they represent.
It's such an obvious push that If you don't want to see it, it makes me think you're shielding yourself to avoid contending with the reality: These politicians and govs all around, including the countries you claim "work" are absolutely power hungry and beholden to interests other than yours and will push for as much total surveillance as they can, including as much curtailment of freedoms as they can.
Obviously that won't mean elites will actually face justice or crimes will actually be solved because more surveillance is not accompanied with more government transparency, quite the opposite and bigger and more powerful burocracies, with more authoritarianism, allow for easy hidden exceptions that you can't question.
It's nothing new. Corruption is common. It's just mediocre to see "hackers" pushing for it just because the government and corporations tell them to, because foreign country bad, bad social media influences kids, drugs, word-ism, etc.
The issue is being raised here: https://github.com/eu-digital-identity-wallet/av-app-android...
As a resident of the aforementioned political climate, I find their concerns to be reasonable.There are a number of comments in that same thread that indicate a mandate to utilize Google services may run afoul of EU member nations' integrity and privacy laws.
https://commission.europa.eu/strategy-and-policy/priorities-...
If the proof can not be traced back to your identity, then what stops a person from creating large amounts of proofs and distributing them?
If the proof can be traced back to your identity, then... that would suck.
Seriously you can't make this stuff up.
https://ageverification.dev/Technical%20Specification/media/...
Essentially, the core user journey is a privacy preserving "over 18" check. I suppose this prevents under 18's from accessing porn, in the same way that most blocking technologies impose an expense on everyone but fail to block tech-savvy children.
Doesn't seem like it could ever stop someone with a bittorrent client, unless you have to attest you are over 18 to even use bittorrent.
You can not check the age without breaking the privacy, technically it is Not possible; this is like a religious faith exercise, not science.
What one read in the specification is, firstly you install an official software in your device, the device becomes identified "as you" the first time you verify your ID and receive your unique internet ID hash, linked to your personal data at the identifier platform.
In addition, your unique internet ID hash will become you, and each time a Non-porn-related platform ask for it, you will leave track of who are you -as internet ID- to the platform (finger printing), and also what you visit to the identifier platform.
Yeah, I said Non-porn-related platform, literally, because what we are reading here is about an Internet digital ID hash for each EU citizen,
Lets be clear, if it were to protect the children from porn, it would say "verify with the personal internet ID only for porn sites", in company with all the adjectives derived from porn, exclusively, with specificity, nothing more.
But what we are seeing here about this matter is deliberately open to interpretation, they say "platform that can be considered to be accessible to minors"... boom, What does this mean, News for adults? Criticise a corrupt government for adults? In my village this is called a back door trojan, because when they want they redact the directives, laws, with precision.
Anyway, I invite the reader to take a look to the Digital ID directive on its own,
https://eur-lex.europa.eu/eli/reg/2024/1183/ (2024)
https://eur-lex.europa.eu/eli/reg/2022/2065/ (2022)
After this, they only have to define progressively, frog cooking time, and increase the affected Internet platforms with obligatory identification, and then we will think that the Great Chinese Firewall was a children game compared with this.
The "it's to protect the children" political tactic to break privacy is quite old. In addition we should remember the other EU law about breaking the encryptions.
My humble opinion.
PS: Ironically no more of two months ago I was saying that as I was European I have freedom and I didn't need a tooling for circumvent something like the Russian and Chinese censure. Oh my... If I were know this, I was absolutely blind about what someones try to cook.
It really seems like tying this to Google violates some key principles of the EU market.
Seriously. You don’t need Google. You just need a plan and a will to execute.
I use GrapheneOS as a daily driver and I absolutely love it. It should be the default. There's already one app I use that must do something similar and absolutely just won't run on it, so I have an entirely separate phone running stock Android just for that one app. Still worth the hassle.
Glad I don't live in a place where all this madness is taking root, but still, the trend itself sucks.
https://news.ycombinator.com/item?id=43715884#43722778
Indeed, the bug links to another bug where the author says that it isn't restricted to Play Services remote attestation and recently followed up with a documentation update making that clear. https://github.com/eu-digital-identity-wallet/eudi-app-andro...
Create a better, standardized, open-source parental control tool that is installed by default on all types of device that can connect to the web.
The internet aspect of the parental control should be a "Per Whitelist" system rather than Blacklisting. The parents should be the ones to decide which domains are Whitelisted for their kids, and government bodies could contribute with curated lists to help establish a base.
Yes, there would be some gray area sites like search engine image search, or social media sites like Twitter that can allow you to stumble into pornography, and that is why these devices that have the software turned ON, should send a token through the browser saying "Parental Control". It would be easier for websites to implement a blanket block of certain aspects of their site than expect them to implement whole ID checks systems and security to make sure that no leaks occur (look at the TEA app) like the UK is expecting everyone to do.
Also, I'm for teenagers (not little children) having access to pornography. I was once a teenager, every adult was, and we know that it's a natural thing to masturbate which includes the consumption of pornography for most in some way. Repressing their desires, their sexuality, and making this private aspect of their life difficult isn't the way. Yes, yes, there is nuance to it, (very hardcore/addiction/etc) but it should be up to the parents to decide with given tools if they trust their kid to consume such a thing.
As for the tool itself. Of course we have parental tools, but they can be pretty garbage, their all different, they're out of the way, and I understand that many people simply don't know how to operate them. That's why I believe that creating a standardized open-source project that multiple governments can directly contribute to and advertise for parents is the way, because at the end of the day, it should be up to the parents to decide these things, and for the government to facility that choice.
Obviously, besides the internet aspect, the tool should have all the bells and whistles that you'd expect from one, but that's not the topic.
EDIT: And yes, some children would find a way, just like they're doing now for the currently implemented ID checks. It's not lost of me that VPNs with free plans suddenly exploded in 4 digits % worth of downloads. A lot of those are tiny people who are smart enough. Or using an app like a game to trick Facial Recognition software.
Who the hell wants this Internet...?
If it's not unbelievably obvious, there's an entire class of people flying private jets to "world summits" where the transcripts aren't disclosed. What do you think is going on? Use your brain.
They flip flop on this stuff at least once a month, and the most annoying part is that they always herald everything they do as some new epoch-defining initiative only to quietly forget about it and do the opposite a few months later.
If nation states are dogs, then EU is the chihuahua: loud, proud and extremely ineffective.
[1] https://grapheneos.org/articles/attestation-compatibility-gu...
Who voted for this? Who asked for this?
these people are monsters. don't help them, and don't be complicit. working on digital ID tech, and even disclosing vulns in it is like helping Hollerith make faster and more efficient punch cards.