31 ms·

EU age verification app to ban any Android system not licensed by Google

1051 points by cft 1y ago

edem 1y ago
> [...] free flow of information is the only safeguard against tyranny. [...] Beware of he who would deny you access to information, for in his heart he deems himself your master
djrj477dhsnv 1y ago
What kind of services will use this app? Unless their governments start issuing Android devices to all of their citizens, I don't understand how they can require use of this app for anything official.
- the_mitsuhiko 1y ago
  > Unless their governments start issuing Android devices to all of their citizens, I don't understand how they can require use of this app for anything official. Not sure who you mean by "they" but you already cannot use a lot of governmental services unless you have an Android or iOS device (at least in Austria). At least in practice that is almost impossible.
  - djrj477dhsnv 1y ago
    By "they" I meant EU member state governments. > you already cannot use a lot of governmental services unless you have an Android or iOS device (at least in Austria). That's terrible. They have official services that require an app and can't be used via a standard browser or even paper forms? What do elderly people without smartphones do?
    - homebrewer 1y ago
      I am in a similar situation, with very aggressive push for turning all banking and every government service into mobile applications only. > What do elderly people without smartphones do? They buy a smartphone and have their relatives set everything up for them. Not doing that isn't really an option because you can't even get your pension or planned (i.e. nonemergency) medical services anymore without going through the government mobile app. If they don't have any relatives, they walk to the government building that used to solve these things for them using good old paper forms, and have officers there help them out. It's a completely braindead system that was envisioned by someone who has very little idea of how the common person lives. Not that there are any channels to provide feedback, ironically enough. (Voting is a sham and has always been so here.)
  - lazka 1y ago
    In Austria you can use a web browser + FIDO key as an alternative. It works nicely. https://ida.gv.at/de/hilfe/hilfe-zu-ida/authentifizierungsfaktoren https://ida.gv.at/de/hilfe/hilfe-zu-ida/authentifizierungsfa...
- wmf 1y ago
  They will support iOS and Android which covers 99.9% of the population.
  - AAAAaccountAAAA 1y ago
    What about the rest? Don't basic rights apply to them?
- jeroenhd 1y ago
  They don't require the app for anything official. Uploading (partially redacted) scans of your ID like you would be obligated to today, or physically verifying your age for things like alcohol delivery, should also suffice.
  - Aachen 1y ago
    > Uploading (partially redacted) scans of your ID like you would be obligated to today Redacted, I wish... To vote in the upcoming election, I was asked to upload an uncensored copy of an identity document to the website of the municipality of The Hague To keep the domain I registered in 2014, the French TLD required me to send them the same thing by unencrypted email a few months ago. I tried sending a link to a PNG so it wouldn't linger in their inbox forever but they absolutely required it to be an attachment To buy a prepaid card in Germany, I was required to show an uncensored identity document. I had put a tiny piece of tape tape over only the burgerservicenummer that the germans can't make use of anyway because it's the Dutch numbering system that's beholden only to specific authorities There's scarcely anyone who appears to know what EU legislation says on identity numbers. The Dutch government themselves apparently don't
isaacremuant 1y ago
So many people advocating for this in HN and elsewhere when it's so clearly a draconian slippery slope for invasive surveillance and choice restriction. After these things get implemented people pretend it was always like this. We don't need the governments to mass surveil us to protect us. We need them to sort the economy and stop invading countries and being deferential to corporate interests instead of the people they represent. It's such an obvious push that If you don't want to see it, it makes me think you're shielding yourself to avoid contending with the reality: These politicians and govs all around, including the countries you claim "work" are absolutely power hungry and beholden to interests other than yours and will push for as much total surveillance as they can, including as much curtailment of freedoms as they can. Obviously that won't mean elites will actually face justice or crimes will actually be solved because more surveillance is not accompanied with more government transparency, quite the opposite and bigger and more powerful burocracies, with more authoritarianism, allow for easy hidden exceptions that you can't question. It's nothing new. Corruption is common. It's just mediocre to see "hackers" pushing for it just because the government and corporations tell them to, because foreign country bad, bad social media influences kids, drugs, word-ism, etc.
- ViktorRay 1y ago
  At the time this comment was posted there was only one other comment in this entire thread. You say “so many people are advocating for this in HN” but this thread was empty except for one other comment (which was also critical of this) at the time you posted your comment.
  - isaacremuant 1y ago
    I think if you use critical thinking to read you may easily find I'm talking about my experience with reading comments in relation to imposing age verification for online access, which means digital ID for internet access. HN and even the GitHub comments mostly start with the assumption that of course we should do this. Of course we should restrict social media to under 16/18s and either are in favor of ID to access the Internet or pretend it won't happen by consequence of this. Now try to address what I said instead of poorly calling me out.
WarOnPrivacy 1y ago
In the case of Android, genuine means: The operating system was licensed by Google The app was downloaded from the Play Store (thus requiring a Google account) Device security checks have passed While there is value to verify device security, this strongly ties the app to many Google properties and services, because those checks won't pass on an aftermarket Android OS The issue is being raised here: https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/issues/10 https://github.com/eu-digital-identity-wallet/av-app-android... I would like to strongly urge to abandon this plan. Requiring a dependency on American tech giants for age verification further deepens the EU's dependency on America and the USA's control over the internet. Especially in the current political climate I hope I do not have to explain how undesirable and dangerous that is. As a resident of the aforementioned political climate, I find their concerns to be reasonable. There are a number of comments in that same thread that indicate a mandate to utilize Google services may run afoul of EU member nations' integrity and privacy laws.
- rightbyte 1y ago
  > As a resident of the aforementioned political climate, I find their concerns to be reasonable. No. The lesson is that stuff like this is concerning what ever the "political climate". Anyway, you mainly don't want the gov in your vicinity to snoop. Non-local OS:es is probably advantageous in that regard if you choose to run proprietary code...
  - johnnyanmac 1y ago
    >No. The lesson is that stuff like this is concerning what ever the "political climate". We say this, but many also want to entrust all our PC games to one closed source launcher. Or have videos/TV all on one subscription service. There's definitely a spectrum of benevolent and greedy dictators people draw lines on.
    - A4ET8a8uTh0_v2 1y ago
      This is genuinely a real issue. It seems that most people cannot forsee an issue down the road unless it just happens to personally affect them after it took place ( ideally immediately after ). Valve is a good example, because while it is providing good value for the service it provides, it will not stay like that forever, but the environment it did set up will. And it will hurt once MBAs divvy up that kingdom. Just sayin' And obviously it is not just one arena, because it seems to be one glaring issue with human beings: they do not want to see the road ahead. And the ones they do are, at best, ignored.
aniviacat 1y ago
Does anyone know how this is implemented? If the proof can not be traced back to your identity, then what stops a person from creating large amounts of proofs and distributing them? If the proof can be traced back to your identity, then... that would suck.
- magicalhippo 1y ago
  The technical specification can be found here[1], with further details here[2]. Well, it's more like a framework, so not a ton of details. I've just glossed over it, but from what I can gather they have thought about it: No personal data, especially no information from personal identification documents such as national ID card, is stored within an [Age Verification App Instance]. Only the Proof of Age attestation, specifically indicating "older than 18", is utilized for age verification purposes Stored Verification(8b): [Relying Parties] may optionally store information derived from the Proof of Age attestation in the User's account, allowing the User to bypass repeated verification for future visits or purchases, streamlining the User experience. In this case, authentication methods such as WebAuthN should be utilised to ensure secure access while enabling the User to choose a pseudonym, preserving privacy. Risks in case of the device sharing should be considered. [1]: https://ageverification.dev/Technical%20Specification/architecture-and-technical-specifications/ https://ageverification.dev/Technical%20Specification/archit... [2]: https://ageverification.dev/Technical%20Specification/annexes/annex-A/annex-A-av-profile/ https://ageverification.dev/Technical%20Specification/annexe...
- JeremyNT 1y ago
  This is the pr on it [0]. It was linked on hn at the time too [1] For all the shit Google deservedly gets they seem to be genuinely trying to implement good and privacy preserving solutions to a lot of these problems. The issue of course is that there's essentially no way to do all this stuff with software and hardware the user actually controls themselves, so you end up with hard requirements that you use big tech as gatekeepers. This is the slippery slope that IMO eventually ends the open web. If you take that outcome as inevitable, which at this point I basically do given all the forces lined up to restrict access to information, I suppose Google is about the best steward you could hope for. [0] https://blog.google/products/google-pay/google-wallet-age-identity-verifications/ https://blog.google/products/google-pay/google-wallet-age-id... [1] https://news.ycombinator.com/item?id=43863672 https://news.ycombinator.com/item?id=43863672
bfg_9k 1y ago
What an absolute clown show - the EU fines Google and Apple for being monopolistic and abusing market power and then proceed to implement apps like these that can only be used on American operating systems. Seriously you can't make this stuff up.
- tonis2 1y ago
  Yeah, EU byrocrats love corporate overlords in real life
- stephen_g 1y ago
  I mean there's a perfectly rational possible explanation for this - if the fines are actually just an extra targeted tax on these companies (but it's politically inconvenient to just do it honestly by levying a tax), and they would therefore adjust the laws to make sure they could still fine them if they had already complied... It may be that the people in charge in the EU don't really care about the market dominance as long as they can collect enough extra money from them...
avidiax 1y ago
For those wondering what the purpose is: https://ageverification.dev/Technical%20Specification/architecture-and-technical-specifications/#23-user-journey https://ageverification.dev/Technical%20Specification/archit... https://ageverification.dev/Technical%20Specification/media/Figure_1_user_journey.png https://ageverification.dev/Technical%20Specification/media/... Essentially, the core user journey is a privacy preserving "over 18" check. I suppose this prevents under 18's from accessing porn, in the same way that most blocking technologies impose an expense on everyone but fail to block tech-savvy children. Doesn't seem like it could ever stop someone with a bittorrent client, unless you have to attest you are over 18 to even use bittorrent.
- GaggiX 1y ago
  >but fail to block tech-savvy children. If I were a kid, I could see myself downloading Opera GX and enabling the free VPN. It's probably not "tech-savvy" because the browser gets a lot of ad views on YouTube; it would be pretty obvious.
  - avidiax 1y ago
    Or using a torrent. Or trading a fileshare with your friends. Or finding a box in the woods. Or finding dad's "tax returns" folder. Or getting on TOR. Or finding an open directory. Or asking AI to produce something. Basically anything other than going to a legally compliant website and trying to attach your mom's passport to the age verification app and doing the challenge.
    - lotsofpulp 1y ago
      > Or finding dad's "tax returns" folder. I would want to sit in on this audit.
      - SauciestGNU 1y ago
        Are you coming onto his dad?
- 1y ago
avidiax 1y ago
Lengthy GitHub issue about this: https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/issues/10 https://github.com/eu-digital-identity-wallet/av-app-android... It really seems like tying this to Google violates some key principles of the EU market.
tetris11 1y ago
I guess GDPR is on the way out, unless Google pinky promises to keep all processing/data local to each EU state?
- wmf 1y ago
  What if the data stays on the phone?
  - deleted 1y ago
    [deleted]
- antonvs 1y ago
  The GDPR data locality requirement is that personal data must remain in the European Economic Area (unless an exception applies.) It has no requirement that data remains local to each state. That's easy for a company like Google to comply with. In fact the company I work for uses Google European data centers to comply with GDPR.
potato3732842 1y ago
If you're wondering what regulatory capture looks like, this is it.
- wmf 1y ago
  It's more likely to be laziness by the developers.
reactordev 1y ago
Asking my EU friends, why do you let yourselves be bamboozled by the US tech companies when you’re totally capable of doing it yourselves? Seriously. You don’t need Google. You just need a plan and a will to execute.
- amelius 1y ago
  You need a pile of money first. And that works differently in the EU.
  - reactordev 1y ago
    You have sovereignty of the EU and nations willing. Don’t say it will take money. Money is fake. You can do this. Everyone’s ready. The only reason US is wealthy is those subscription fees and vendor lock in we have.
    - amelius 1y ago
      They will be sued by Google for illegal state aid.
      - globalnode 1y ago
        who cares, money is fake (as stated above), pay the fines and move on with an EU OS
      - reactordev 1y ago
        Cool, in what court? EU court? It would be the EU doing this. Want to do business in the EU, GDPR extends to giving us the keys as well if you’re going to valet park here. Or they can go kick rocks while smart engineers in member countries build a new android. After all, a lot has changed since someone decided to bolt Java onto a Linux kernel.
        anticensor 1y ago
        ICJ?
latentsea 1y ago
Ugh. There's just no winning with tech anymore. I use GrapheneOS as a daily driver and I absolutely love it. It should be the default. There's already one app I use that must do something similar and absolutely just won't run on it, so I have an entirely separate phone running stock Android just for that one app. Still worth the hassle. Glad I don't live in a place where all this madness is taking root, but still, the trend itself sucks.
- superkuh 1y ago
  The only winning move is not to play the game. One has to have a phone these days but you don't have to do your computing on it (during personal time). Use a real computer instead.
  - latentsea 1y ago
    Great advice that I just can't take.
  - IlikeKitties 1y ago
    > I would like to pay for goods and services online. > Very well sir, which digital payment service would you like to use? > It doesn't matter they all force me to use my phone.
    - ranyume 1y ago
      It's pretty crazy. You can be authenticated on a website, and the website still asks you to use your phone to.. validate what you're doing on the pc.
  - Aachen 1y ago
    This software doesn't run on a real computer. The point of the submission is that it only runs on a DRM device from two entrenched vendors
    - superkuh 1y ago
titanomachy 1y ago
Without getting into the ideological weeds too much, is there a solid technical reason for this? Like if this verification wasn’t in place, could I just alter the source code or binary to always return “yes I’m 18” (or whatever) and completely subvert the intent of this tool? If so, is there a straightforward way to prevent this without involving Google?
- fluidcruft 1y ago
  I'm pretty sure all you need is the ability to login to a website and for that site to vouch for your age based on having examined your identification documents (or something like a network of PGP web-of-trust type notaries). I have a hunch that using a hardware token and biometrics is required to prevent fraud (FIDO and passkeys etc should work). The trick is preventing simulated tokens from existing/working which is where secure boot etc enter the picture.
  - Aachen 1y ago
    Can you clarify what fraud you're thinking the "secure boot" (which I take to mean: being denied the access to control your own device) would prevent? Since the identity documents you already have, have this chip that works the same as your bank card, you really don't need a relaying party (your phone, your ISP, etc.) to be trusted for the receiving website to be able to verify the cryptographic signature on the data
    - fluidcruft 1y ago
      Fraud would be someone who is not you using your identity.
      - Aachen 1y ago
        So the scenario this is needed for, is where someone does a physical and technical attack on your phone just to extract the key from this app that says you're 18+. That would be why nobody can have access to their own data anymore I'm sorry but that cure is definitely worse than the disease. This is not an attack you see outside of spy movies
Edmond 1y ago
There is a correct cryptographic solution for information verification online: https://news.ycombinator.com/item?id=43715884#43722778 https://news.ycombinator.com/item?id=43715884#43722778
deleted 1y ago
[deleted]
lern_too_spel 1y ago
No evidence is given that they won't implement non-Google remote attestation solutions like https://attestation.app/about https://attestation.app/about Indeed, the bug links to another bug where the author says that it isn't restricted to Play Services remote attestation and recently followed up with a documentation update making that clear. https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui/issues/287#issuecomment-3084857018 https://github.com/eu-digital-identity-wallet/eudi-app-andro...
- saubeidl 1y ago
  No evidence is given they will.
  - lern_too_spel 1y ago
    You replied after I had updated the comment to provide said evidence. Adding to what I said earlier, this isn't even an app that any EU member state will use. It's just a PoC, as it says in the README. https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui https://github.com/eu-digital-identity-wallet/av-app-android... Unfortunately for the authors, the pitch forks are already out, and the mob is on the march. It's too bad that HN is contributing to it.
    - antonvs 1y ago
      It's good that there are strong reactions to dystopian work like this. It's solving a problem that doesn't need to be solved using a solution that's fraught with risks. The authors chose to spend their time helping governments censor information, removing choice from individuals, and the solution they choose to work on is a bad one. Any criticism they receive is well-deserved.
      - lern_too_spel 1y ago
        There are already age check requirements to do things like buy liquor online. Today, that requires uploading your ID, so the service provider gets a lot more information than just that you're above a certain age. The existence of this new way to prove your age without giving away a bunch of other information does not "[help] governments censor information" in any reasonable way.
lemoncookiechip 1y ago
We shouldn't need Age Verification checks for adults in the first place. Create a better, standardized, open-source parental control tool that is installed by default on all types of device that can connect to the web. The internet aspect of the parental control should be a "Per Whitelist" system rather than Blacklisting. The parents should be the ones to decide which domains are Whitelisted for their kids, and government bodies could contribute with curated lists to help establish a base. Yes, there would be some gray area sites like search engine image search, or social media sites like Twitter that can allow you to stumble into pornography, and that is why these devices that have the software turned ON, should send a token through the browser saying "Parental Control". It would be easier for websites to implement a blanket block of certain aspects of their site than expect them to implement whole ID checks systems and security to make sure that no leaks occur (look at the TEA app) like the UK is expecting everyone to do. Also, I'm for teenagers (not little children) having access to pornography. I was once a teenager, every adult was, and we know that it's a natural thing to masturbate which includes the consumption of pornography for most in some way. Repressing their desires, their sexuality, and making this private aspect of their life difficult isn't the way. Yes, yes, there is nuance to it, (very hardcore/addiction/etc) but it should be up to the parents to decide with given tools if they trust their kid to consume such a thing. As for the tool itself. Of course we have parental tools, but they can be pretty garbage, their all different, they're out of the way, and I understand that many people simply don't know how to operate them. That's why I believe that creating a standardized open-source project that multiple governments can directly contribute to and advertise for parents is the way, because at the end of the day, it should be up to the parents to decide these things, and for the government to facility that choice. Obviously, besides the internet aspect, the tool should have all the bells and whistles that you'd expect from one, but that's not the topic. EDIT: And yes, some children would find a way, just like they're doing now for the currently implemented ID checks. It's not lost of me that VPNs with free plans suddenly exploded in 4 digits % worth of downloads. A lot of those are tiny people who are smart enough. Or using an app like a game to trick Facial Recognition software.
mk89 1y ago
I am not sure if I am more disturbed by the user journey they want to introduce for accessing websites or the fact that a private company (american, chinese, I don't care) has to become the gatekeeper to let me in. Who the hell wants this Internet...?
- heavyset_go 1y ago
  > Who the hell wants this Internet...? Scared rich people and bureaucrats
- IlikeKitties 1y ago
  > Who the hell wants this Internet...? The under educated, unthinking unwashed masses. Just look at the tea leak. The amount of people that do not care about freedom or privacy on the internet vastly outnumber those that do. And because they do democracy unmasks itself in the digital realm as the tyranny of the unthinking majority. Weep for the future.
- ranyume 1y ago
  The lazy middle class who don't like to take the responsibility of actually contributing to their community and running their family. ps: Had to add this post after the others identified the low class and the upper class as responsible for this ;). But depending on where you are, the low class might not be "the masses".
- clarionbell 1y ago
  Well meaning nordic liberals? They have been pushing chat control, I assume this is their idea as well.
- _0ffh 1y ago
  Politicians and their buddies scared of having lost control of mass media.
marcinzm 1y ago
Looks like someone just got a really cushy job at Google when they retire from leading this system.
exabrial 1y ago
Lol. People put way too much trust in governments. If it's not unbelievably obvious, there's an entire class of people flying private jets to "world summits" where the transcripts aren't disclosed. What do you think is going on? Use your brain.
- johnisgood 1y ago
  I don't know why people on here love the Government. They are probably advocating for a Government, but not this. A government that does its basic functions, without too much overreach, something like minarchism.
0x_rs 1y ago
The war on the free internet is accelerating. Without real push-back to these dystopian laws and consequences for the people proposing and lobbying for them, you'll miss what will ultimately end up being a temporary anomaly of mostly unrestrained free flow of information. It's not an hypothetical scenario or something that will develop down the line, it's happening today, worldwide.
- quantummagic 1y ago
  They always start with "think of the children", but that's just the opening salvo. The wild west days of the internet are definitely behind us. We'll be lucky if we still have private personal computing in the future, or any semblance of free speech.
  - akersten 1y ago
    If we're to regain any ground here we need to adjust the messaging wrt terms like "wild west" - that's precisely the kind of terminology that scares the average voter into thinking the government needs to do something about this whole internet thing. We need to use patriotic and inspiring language, like "free" as in "free speech for the internet," or "safe and private" etc
  - pixxel 1y ago
    [dead]
- RpFLCL 1y ago
  I heard from a friend last night that they were unable to see posts on X about current protests in their country because those were considered "adult" content which can now only be viewed after submitting to an ID check. Not porn, video of a protest. You're 100% right that it's happening today.
  - stinkbeetle 1y ago
    Sadly the old guard of free speech and privacy activists on the internet has long gone, drowned by a sea of unprincipled populist reactionaries - if their team decided that the content is "problematic", then they are entirely justified in censoring and punishing the speakers for daring to speak it, and entirely justified in protecting everybody else from having to suffer the horror of reading/seeing/hearing it, and it matters not whether the mechanisms are legal or ethical because the ends justify the means.
snickerbockers 1y ago
The European union never ceases to amaze me. Whatever happened to becoming less dependent on American corporations? They flip flop on this stuff at least once a month, and the most annoying part is that they always herald everything they do as some new epoch-defining initiative only to quietly forget about it and do the opposite a few months later. If nation states are dogs, then EU is the chihuahua: loud, proud and extremely ineffective.
- alephnerd 1y ago
  > They flip flop on this stuff at least once a month Because in the background it's a French vs German vs Irish vs Czech vs $insert_eu_state business interests competing with each other. Notice how it's almost always French legislators and businesses that mention "domestic EU tech" and not Polish, Czech, Romanian, Dutch, or even German policymakers or businesses? That's why. National interests always end up trumping the EU in it's current form. And for a large portion of the EU, American BigTech represents the majority of FDI (tech and overall). Japanese and Korean automotive players did the same thing with the US in the 1980s-90s in order to ensure their interests remained aligned (though the Plaza Accords did play a role)
  - BLKNSLVR 1y ago
    France has some history in being disappointed by the US, so it doesn't really surprise me that France is beating the independence drum the loudest. https://www.youtube.com/watch?v=Px9qhDGv300&t=150s https://www.youtube.com/watch?v=Px9qhDGv300&t=150s. (the entire video is interesting and informative, I've skipped it to the France-US specific part, up to about 11:02 where Australia is introduced as the US sycophant it is) Whether it's logical or not, offences past, even those thought forgotten, are easily recalled when under similar pressures.
    - alephnerd 1y ago
      > Whether it's logical or not From an American NatSec perspective, French strategic autonomy is viewed as a positive, as can be seen with Elbridge Colby's work (and similar work by Mastro and Doshi), and a lot of the initiatives led by the Biden admin, as this would allow burden sharing because the US is no longer in a position to manage a two continent war. France does our dirty work in the Sahel and can help in the Indo-Pac (as was seen with the US, France, and India jointly armtwisting the UK into ceding Diego Garcia to Marutius) In Australia's case (and to the US's benefit), alignment with France makes sense and has been something that has come up in Australian NatSec for years. New Caledonia is barely 800 miles off the coast of Australia and NZ, and both New Caledonia and French Polynesia have faced pressure due to China, especially after the recent violence in New Caledonia was linked to Azeri [5] disinfo networks on TikTok, along with decades of covert ops by China in New Caledonia [6][7]. France has also been an active defense partner with India and Indonesia - both of whom are increasingly cornerstones of Australian defense. By every single standard, having an active "Indo-Pac" France is a net benefit for America+ strategy and Taiwan. That said, French NatSec "strategic autonomy" does not have anything to do with French industry's alignment with marketing a "European first" tech story. France has similar issues to the US with power politics (as can be seen with France, US, SK, and Israel sharing a similar CPI score), and the biggest booster and beneficiary for "European Tech" is Xavier Niel [0] (France's Mark Cuban or Elon Musk), who is on a first-name basis with Macron [1][2] and whose Father-in-Law (Bernard Arnault) has personally played a significant role in French power politics for years [3][4]. Arnault is also the reason why every country negotiating with the EU ALWAYS tariffs congac and champagne - Arnault's LVMH owns Hennessy and all the other congac producers, and the majority of champagne producers. End of the day, this is just another inter-elite conflict between vested business interests like any other, but couched with the flag of nationalism. Nothing wrong with that, but this is why you don't see alignment amongst EU member states - as each state is supporting their own vested business interests amidst a trade war. For example, there's a reason all of us American tech investors end up working with the same handful of politically aligned law firms in Czechia or ending up in the same IT Parks in Eastern Europe. [0] - https://www.bloomberg.com/opinion/articles/2025-02-12/xavier-niel-s-not-ready-to-throw-in-the-towel-on-ai https://www.bloomberg.com/opinion/articles/2025-02-12/xavier... [1] - https://www.lemonde.fr/en/politics/article/2024/12/22/emmanuel-macron-s-art-of-secrecy_6736366_5.html https://www.lemonde.fr/en/politics/article/2024/12/22/emmanu... [2] - https://www.bloomberg.com/news/articles/2018-05-22/french-mindset-shift-under-macron-poised-to-boost-startups-levy https://www.bloomberg.com/news/articles/2018-05-22/french-mi... [3] - https://www.reuters.com/business/media-telecom/insight-macron-moguls-inside-fight-over-french-fox-news-2020-12-17/ https://www.reuters.com/business/media-telecom/insight-macro... [4] - https://www.lemonde.fr/en/economy/article/2023/08/08/bernard-arnault-and-the-most-powerful-address-book-in-france_6085516_19.html https://www.lemonde.fr/en/economy/article/2023/08/08/bernard... [5] - https://www.aspistrategist.org.au/russia-azerbaijan-exploit-new-caledonian-strife-against-france-china-stays-mum/ https://www.aspistrategist.org.au/russia-azerbaijan-exploit-... [6] - https://www.aspi.org.au/report/when-china-knocks-door-new-caledonia/ https://www.aspi.org.au/report/when-china-knocks-door-new-ca... [7] - https://www.lemonde.fr/en/pixels/article/2024/05/16/why-and-how-tiktok-was-banned-in-new-caledonia_6671655_13.html https://www.lemonde.fr/en/pixels/article/2024/05/16/why-and-...
nabakin 1y ago
Unfortunately this isn't the first time a government has banned Android devices which are not licensed by Google. GrapheneOS has a list of them[1] [1] https://grapheneos.org/articles/attestation-compatibility-guide#apps-banning-grapheneos https://grapheneos.org/articles/attestation-compatibility-gu...
- pfoof 1y ago
  For Authy I don’t even feel sorry. Proprietary TOTP. sorry for off-topic
- preisschild 1y ago
  The Austrian ID App was also blocking GrapheneOS due to SafetyNet verification... After a lot of angry emails towards the helpdesk, they at least changed it, so a failed check only shows a warning that you can accept.
Arch-TK 1y ago
It's absolutely abysmal that the EU and UK are implementing laws relating to age verification requirements. Who voted for this? Who asked for this?
- johnisgood 1y ago
  The whole Chat Control crap is bullshit no one asked for, and unfortunately many countries in the EU are in favor of it. There is a map somewhere that shows the countries that are against it, I cannot find it right now.
  - nickslaughter02 1y ago
    https://www.patrick-breyer.de/wp-content/uploads/2024/12/signal-2024-12-11-152711-002-2.jpeg https://www.patrick-breyer.de/wp-content/uploads/2024/12/sig...
    - johnisgood 1y ago
      Yes, that, although I wish they made a distinction between abstain vs. opposed.
      - nickslaughter02 1y ago
        Updated after the last meeting: https://digitalcourage.social/system/media_attachments/files/114/946/559/217/657/887/original/a741ac2bcf13f1c9.png https://digitalcourage.social/system/media_attachments/files...
- luke727 1y ago
  Unfortunately many more people than you might think are in full support of this type of thing. The UK in particular is a very nanny state and this is sold as protecting children. You're not against protecting children, are you?
  - johnisgood 1y ago
FpUser 1y ago
Sure, so much for freedom of choice and twisting people's arms. What is it their fucking leaders sing about being freedom loving and democratic?
motohagiography 1y ago
"age verification app," is such a phony pretext. They know that android fragmentation and the lack of consistent verifiable hardware is what prevents govts from implementing a punitive digital ID that is sufficient to punish and fine people using western standards of evidence and legal defense. these people are monsters. don't help them, and don't be complicit. working on digital ID tech, and even disclosing vulns in it is like helping Hollerith make faster and more efficient punch cards.
bluecalm 1y ago
Funny how EU politicians complain about dependency on American tech and the next day do something like this. It's all cheap talk anyway as they have 0 intention to make EU based alternatives possible but it's rarely in your face so much.
perching_aix 1y ago
This collision course has been a long time brewing, though I'm not even sure why integrity checking is included in this. The data source for the age information is the governments, there's no need to trust the clientside per se, it's just a middleman. One thing I find reassuring is the nature of pushback on display on the repo (only read the first few comments there, mind you). Really not what I expected phrasing and rhetoric wise (unlike here), honestly kind of restored a very very tiny and fragile bit of faith in humanity in me, it's very reserved and reasonable stuff.
yupyupyups 1y ago
This has nothing to do with age verification, but everything to do with identifying users on various services. They can compell the providers of said services to give them access to how each, now identified, user is using the service. Since a lot of our lives are digital, this is a major transfer of power from the people to a select few. A question I have is who voted for this? I sure didn't.
- ranyume 1y ago
  It's called representative democracy and it's been in crisis for some years now.
  - dekken_ 1y ago
    It's so indirect it's hard to even consider it a form of democracy. I don't.
  - Saline9515 1y ago
    The European Commission is unelected. The European parliament can't choose which laws it wants to vote on. This is a simulacrum of democracy.
- lern_too_spel 1y ago
  > They can compell the providers of said services to give them access to how each, now identified, user is using the service. The whole point of this is that they can't, which is unlike the systems they had used before. The only information that the service provider receives is that an age check has passed.
hnpolicestate 1y ago
The problem isn't being handcuffed by Google or an American company, it's being handcuffed at all. Is it some kind of psychological coping skill to misdirect from the obvious problem (an age verification app that bans user software preferences)? Who cares if it's Google or an American company. The point is you decided to let the E.U dictate what software you can run on your phone.
jajuuka 1y ago
I think this misses the forest for the trees. I could care less if the app requires a Google Android phone or non-jailbroken iPhone to work. I care that age verification exists in the first place, when it most definitely shouldn't. Arguing and ranting about how a huge privacy compromise functions misses the point that privacy is being compromised. It's just odd to see them bringing up America when their own government created this. Not the US. How about fight the actual problem instead of making sure the problem works on more devices.
scarface_74 1y ago
I never want to read about how the EU “cares about people’s privacy” unlike the evil US
- johnisgood 1y ago
  Neither cares about privacy, to be honest.
glitchc 1y ago
I wonder if this requirement stemming from the recently announced trade deal with the US.
- progval 1y ago
  It's not. You can look at the Git history, it was added two months ago: https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/commit/15073d7059bcf9d1496a3ec294541bd55ce262e9 https://github.com/eu-digital-identity-wallet/av-app-android...
BLKNSLVR 1y ago
What "things" are going to depend on this Android-locked age check? What about Apple users? What about accessing it via a laptop or desktop (shock horror: running Linux!)? My dad gets by in his "my dad" way of life without a mobile phone at all, I wonder how much longer this will be possible. I was about to rant about being forced to have a mobile if you want to participate in society, but then he uses a desktop for some of the services for which the rest of us use a mobile, so my rant falls down in that, for a while now, to participate in society you've needed either a computer or a mobile. Hopefully computer-only can eke out some kind of base-adequate participation for a while longer.
- jeroenhd 1y ago
  iOS also be supported and will use Apple's remote attestation capabilities. But, as there are no real alternative ROMs for iOS devices, only Android users are really affected by this. From a legal point of view, the app should be a reliable convenience feature and not replace traditional (physical) identity verification. How much your dad will be affected will depend on how shitty and lazy the services he uses are. If he doesn't use a phone or a computer, he probably won't notice the difference.
- Aachen 1y ago
  You can also buy an Apple device but that was never your device to begin with so nothing is lost when the EU requires Apple to be the only party with the capability to modify what your device can run
danielscrubs 1y ago
Any EU friends can tell me which politicians are behind this?
WhereIsTheTruth 1y ago
Europeans, fighting for European sovereignty, bowing down to Google and Microsoft How sad is that, Europeans, you have fallen this low
hulitu 1y ago
> EU age verification app to ban any Android system not licensed by Google Oh, so now we know who is pushing for age verification. FAANG
- jonathanstrange 1y ago
  They're pushing for anything that makes their services essential and indispensable for every citizen, and thereby locks all future competition out.
pabs3 1y ago
A URL without requirement to login to Reddit: https://old.reddit.com/r/degoogle/comments/1mau7yl/eu_age_verification_app_to_ban_any_android_system/ https://old.reddit.com/r/degoogle/comments/1mau7yl/eu_age_ve...
MrDresden 1y ago
The title of the submission is misleading. The linked Reddit discussion is about the issue of attestation in the EU age verification application requiring a licensed version of Android to function properly. The EU is not banning non licensed Android systems. This would make it hard for EU citizens to use those though, if they need that app.
elric 1y ago
I'm getting pretty tired of the EU trying to shove internet-crippling regulations down my throat. This, along with ChatControl, is clearly a path towards totalitarian control. Who are the politicians making these decisions? How did they get elected? Did anyone vote for Totalitarianism 2.0?
- Oras 1y ago
  Governments are reflection of their people, like it or not.
  - elric 1y ago
    Are they, though? The people don't elect the European Commission. The European Council selects candidates and the European Parliament can vote for them. The people in the European Parliament are often politicians who no one knows but sort of vote for because they're associated with their preferred party. I don't recall any party campaigning on reducing internet freedoms.
- Llamamoe 1y ago
  Politicians are all that stands between corporations and absolute corruption. It's why they're both their primary target and the ambition of greedy people.
- lern_too_spel 1y ago
  > I'm getting pretty tired of the EU trying to shove internet-crippling regulations down my throat And I'm getting tired of people pulling out pitchforks without reading anything. This is how democracies end up electing people like Trump. There are no regulations to require age verification here. The EU is simply giving guidelines for implementing harmonized age verification across the EU if any member states or companies that do business in the EU want to use it instead of making people scan ID cards like they currently do and making the receiver of said scans have to understand updates to the designs of the various ID cards used throughout the EU.
  - elric 1y ago
renewiltord 1y ago
I know you can’t access the Internet but at least you can use USB-C. Europe LOL!
redbell 1y ago
The first comment was hilarious: "so how does one report the EU for breaching GDPR" and it reminds me of a comment on r/androiddev where Google was requiring solo devs to have a verifiable phone number for support and the commenter said something like: "Meanwhile, Google itself do not have a support phone number for his Android devs!"
Traubenfuchs 1y ago
Will this be the end of kyc companies like veriff, onfido, jumio, trulioo and whatever else is this crowded space in europe? Will people sign up to banks and betting apps with their eu wallet digital identity?
deleted 1y ago
[deleted]
jruohonen 1y ago
A lot of discussion, but one contradiction seems to have gone unnoticed; notably, the EU's DMA decision about Apple having to allow alternative app stores. Go figure again about these contradictory moves.
trklausss 1y ago
EU: "We need to decouple from the independence of the US". Many (local and national) entities proceed to ditch Microsoft for it. Also the EU: Well if you don't have a Google or Apple account you are not getting age verified.
ozgrakkurt 1y ago
Wow, kids are installing random operating systems from internet into their phones right?
frafra 1y ago
Play Integrity API requirement dropped: https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui/commit/9367289f3da1abd7f2cff0e7e05d67a95f4fdf60 https://github.com/eu-digital-identity-wallet/eudi-app-andro...
- its-summertime 1y ago
  That is a different repo
  - lern_too_spel 1y ago
    That is the repo that this PoC is forked from.
    - its-summertime 1y ago
      even if changes were pulled from that repo, they wouldn't make it into the downstream repo as that file has been near completely replaced, not that it is a change of anything more than a line of text in a readme
chmod775 1y ago
At the end of the day someone could always grab this code, remove the verification step, and distribute that as a new app.
- no_time 1y ago
  That "someone" doesn't understand how hardware backed platform attestation works. The wikipedia page does a pretty good job at explaining it: https://en.wikipedia.org/wiki/Trusted_Computing https://en.wikipedia.org/wiki/Trusted_Computing
  - chmod775 1y ago
    Yes, they do. There's nothing in the spec this app implements that actually requires that step. The app just chooses to do it in this case. Or rather is planning to. Right now it doesn't even have that integrity check, despite fully implementing the verification flow.
pastage 1y ago
You can't use device verification in production anyways. (ATM) This has no effect, is it even used in production anywhere? It seems to be part of eIDAS which is a good thing, most countries already have their own identity systems as is stated in the README. The three or for id apps I have seen all have some kind of device check that is sent to the ID provider, it is not usually accisible for ServiceProviders though. On those apps you either get no indication or just a "seems suspicious" score. The one in Sweden has a "return risk option". https://developers.bankid.com/api-references/auth--sign/auth https://developers.bankid.com/api-references/auth--sign/auth This does not make it possible to filter out people. And honestly considering the amount of shady phones people have I am not sure this will every work. Apple is sadly another issue, too many normals there. It is nice that this is pointed out so we do not get a distopian future.
jonathanstrange 1y ago
This is ridiculous but it's worth pointing out that if the EU would provide their own infrastructure for "age verification" it would be even more Dystopian. The problem is not really that the EU in this case would give Google and Apple monopolies that locks out all competition, the problem is the "age verification" itself. Nobody needs, nobody wants it, and it's the starting point for all kinds of browsing and chat control measures dictated by governments.
OhioMan2943 1y ago
All by design :)
ribcage 1y ago
[dead]
zoobab 1y ago
With the vassalisation of the EU, this is yet another prof that the European Commission and some other countries follow what the US wants. Bad deal all along.
rdm_blackhole 1y ago
A while ago, when the topic of the EU digital ID was brought up, I said clearly that this was going to be shit-show and that the intent was going to use this as tool to muzzle the population. It turns out I was right. This is the intent. First require digital ID to access content/post anything on social media, then make it impossible to use said ID outside of the walled garden of Android and Apple, then tie this digital identity to your real world ID and make sure it can be revoked at anytime by the powers that be. Bonus point, make sure everything you say or do is stored for unlimited access by law enforcement to protect the democracy(TM) or protect the children(TM). If that is not a slippery slope, then I don't know what it is. I also pointed out that creating a database of everyone in the EU containing a lot of PII in terms of religious preferences, sexual preferences and so on is a the stupidest idea that anyone could have considering that this tool could be used by the next parties in power to hunt down political/religious opponents. Nobody can say that they did not know.
phtrivier 1y ago
I don't understand how the poster of the message goes from the disclaimer tet: > The current release provides only basic functionality, with several key features to be introduced in future versions, including: > - App and device verification based on Google Play Integrity API and Apple App Attestation > - Additional issuance methods beyond the currently implemented eID based method. > These planned features align with the requirements and methods described in the Age Verification Profile. to the "In the case of Android, genuine means"... I don't see the word "genuine" in the disclaimer. Is that a necessary part of using the "Google Play Integrity API" ? (I'm genuinely asking, I feel like I'm missing some implicit context here.)
SpicyLemonZest 1y ago
I don't understand what device verification is even meant to do here. What's the threat model of a child who knows how to root their phone and defeat verification checks manually but doesn't know how to find an adult to create an account and give them the password?
- Ray20 1y ago
  It is to create an infrastructure for global surveillance and control of all citizens.
okokwhatever 1y ago
Internet has become a commidity that needs to be reinvented with a focus in the real human interactions and the privacy. How?, who?, Where? I'm afraid it is too late to find a group of people interested in creating a real network outside of the system. The best that i found was the LoRa communities but are useless for anyone submerged in the Tiktokian distopy.
nicman23 1y ago
who do we contact for this mess?
invig 1y ago
This is a problem that needs to be solved. I guess we should have solved it before the regulators got involved, alas, here we are.
evanjrowley 1y ago
Wouldn't this be in direct conflict with the DMA?

1051 points by cft 1y ago

edem 1y ago

> [...] free flow of information is the only safeguard against tyranny. [...] Beware of he who would deny you access to information, for in his heart he deems himself your master

djrj477dhsnv 1y ago

What kind of services will use this app? Unless their governments start issuing Android devices to all of their citizens, I don't understand how they can require use of this app for anything official.

the_mitsuhiko 1y ago
> Unless their governments start issuing Android devices to all of their citizens, I don't understand how they can require use of this app for anything official. Not sure who you mean by "they" but you already cannot use a lot of governmental services unless you have an Android or iOS device (at least in Austria). At least in practice that is almost impossible.
- djrj477dhsnv 1y ago
  By "they" I meant EU member state governments. > you already cannot use a lot of governmental services unless you have an Android or iOS device (at least in Austria). That's terrible. They have official services that require an app and can't be used via a standard browser or even paper forms? What do elderly people without smartphones do?
  - homebrewer 1y ago
    I am in a similar situation, with very aggressive push for turning all banking and every government service into mobile applications only. > What do elderly people without smartphones do? They buy a smartphone and have their relatives set everything up for them. Not doing that isn't really an option because you can't even get your pension or planned (i.e. nonemergency) medical services anymore without going through the government mobile app. If they don't have any relatives, they walk to the government building that used to solve these things for them using good old paper forms, and have officers there help them out. It's a completely braindead system that was envisioned by someone who has very little idea of how the common person lives. Not that there are any channels to provide feedback, ironically enough. (Voting is a sham and has always been so here.)
- lazka 1y ago
  In Austria you can use a web browser + FIDO key as an alternative. It works nicely. https://ida.gv.at/de/hilfe/hilfe-zu-ida/authentifizierungsfaktoren https://ida.gv.at/de/hilfe/hilfe-zu-ida/authentifizierungsfa...
wmf 1y ago
They will support iOS and Android which covers 99.9% of the population.
- AAAAaccountAAAA 1y ago
  What about the rest? Don't basic rights apply to them?
jeroenhd 1y ago
They don't require the app for anything official. Uploading (partially redacted) scans of your ID like you would be obligated to today, or physically verifying your age for things like alcohol delivery, should also suffice.
- Aachen 1y ago
  > Uploading (partially redacted) scans of your ID like you would be obligated to today Redacted, I wish... To vote in the upcoming election, I was asked to upload an uncensored copy of an identity document to the website of the municipality of The Hague To keep the domain I registered in 2014, the French TLD required me to send them the same thing by unencrypted email a few months ago. I tried sending a link to a PNG so it wouldn't linger in their inbox forever but they absolutely required it to be an attachment To buy a prepaid card in Germany, I was required to show an uncensored identity document. I had put a tiny piece of tape tape over only the burgerservicenummer that the germans can't make use of anyway because it's the Dutch numbering system that's beholden only to specific authorities There's scarcely anyone who appears to know what EU legislation says on identity numbers. The Dutch government themselves apparently don't

isaacremuant 1y ago

So many people advocating for this in HN and elsewhere when it's so clearly a draconian slippery slope for invasive surveillance and choice restriction. After these things get implemented people pretend it was always like this. We don't need the governments to mass surveil us to protect us. We need them to sort the economy and stop invading countries and being deferential to corporate interests instead of the people they represent. It's such an obvious push that If you don't want to see it, it makes me think you're shielding yourself to avoid contending with the reality: These politicians and govs all around, including the countries you claim "work" are absolutely power hungry and beholden to interests other than yours and will push for as much total surveillance as they can, including as much curtailment of freedoms as they can. Obviously that won't mean elites will actually face justice or crimes will actually be solved because more surveillance is not accompanied with more government transparency, quite the opposite and bigger and more powerful burocracies, with more authoritarianism, allow for easy hidden exceptions that you can't question. It's nothing new. Corruption is common. It's just mediocre to see "hackers" pushing for it just because the government and corporations tell them to, because foreign country bad, bad social media influences kids, drugs, word-ism, etc.

ViktorRay 1y ago
At the time this comment was posted there was only one other comment in this entire thread. You say “so many people are advocating for this in HN” but this thread was empty except for one other comment (which was also critical of this) at the time you posted your comment.
- isaacremuant 1y ago
  I think if you use critical thinking to read you may easily find I'm talking about my experience with reading comments in relation to imposing age verification for online access, which means digital ID for internet access. HN and even the GitHub comments mostly start with the assumption that of course we should do this. Of course we should restrict social media to under 16/18s and either are in favor of ID to access the Internet or pretend it won't happen by consequence of this. Now try to address what I said instead of poorly calling me out.

WarOnPrivacy 1y ago

In the case of Android, genuine means: The operating system was licensed by Google The app was downloaded from the Play Store (thus requiring a Google account) Device security checks have passed While there is value to verify device security, this strongly ties the app to many Google properties and services, because those checks won't pass on an aftermarket Android OS The issue is being raised here: https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/issues/10 https://github.com/eu-digital-identity-wallet/av-app-android... I would like to strongly urge to abandon this plan. Requiring a dependency on American tech giants for age verification further deepens the EU's dependency on America and the USA's control over the internet. Especially in the current political climate I hope I do not have to explain how undesirable and dangerous that is. As a resident of the aforementioned political climate, I find their concerns to be reasonable. There are a number of comments in that same thread that indicate a mandate to utilize Google services may run afoul of EU member nations' integrity and privacy laws.

rightbyte 1y ago
> As a resident of the aforementioned political climate, I find their concerns to be reasonable. No. The lesson is that stuff like this is concerning what ever the "political climate". Anyway, you mainly don't want the gov in your vicinity to snoop. Non-local OS:es is probably advantageous in that regard if you choose to run proprietary code...
- johnnyanmac 1y ago
  >No. The lesson is that stuff like this is concerning what ever the "political climate". We say this, but many also want to entrust all our PC games to one closed source launcher. Or have videos/TV all on one subscription service. There's definitely a spectrum of benevolent and greedy dictators people draw lines on.
  - A4ET8a8uTh0_v2 1y ago
    This is genuinely a real issue. It seems that most people cannot forsee an issue down the road unless it just happens to personally affect them after it took place ( ideally immediately after ). Valve is a good example, because while it is providing good value for the service it provides, it will not stay like that forever, but the environment it did set up will. And it will hurt once MBAs divvy up that kingdom. Just sayin' And obviously it is not just one arena, because it seems to be one glaring issue with human beings: they do not want to see the road ahead. And the ones they do are, at best, ignored.

aniviacat 1y ago

Does anyone know how this is implemented? If the proof can not be traced back to your identity, then what stops a person from creating large amounts of proofs and distributing them? If the proof can be traced back to your identity, then... that would suck.

magicalhippo 1y ago
The technical specification can be found here[1], with further details here[2]. Well, it's more like a framework, so not a ton of details. I've just glossed over it, but from what I can gather they have thought about it: No personal data, especially no information from personal identification documents such as national ID card, is stored within an [Age Verification App Instance]. Only the Proof of Age attestation, specifically indicating "older than 18", is utilized for age verification purposes Stored Verification(8b): [Relying Parties] may optionally store information derived from the Proof of Age attestation in the User's account, allowing the User to bypass repeated verification for future visits or purchases, streamlining the User experience. In this case, authentication methods such as WebAuthN should be utilised to ensure secure access while enabling the User to choose a pseudonym, preserving privacy. Risks in case of the device sharing should be considered. [1]: https://ageverification.dev/Technical%20Specification/architecture-and-technical-specifications/ https://ageverification.dev/Technical%20Specification/archit... [2]: https://ageverification.dev/Technical%20Specification/annexes/annex-A/annex-A-av-profile/ https://ageverification.dev/Technical%20Specification/annexe...
JeremyNT 1y ago
This is the pr on it [0]. It was linked on hn at the time too [1] For all the shit Google deservedly gets they seem to be genuinely trying to implement good and privacy preserving solutions to a lot of these problems. The issue of course is that there's essentially no way to do all this stuff with software and hardware the user actually controls themselves, so you end up with hard requirements that you use big tech as gatekeepers. This is the slippery slope that IMO eventually ends the open web. If you take that outcome as inevitable, which at this point I basically do given all the forces lined up to restrict access to information, I suppose Google is about the best steward you could hope for. [0] https://blog.google/products/google-pay/google-wallet-age-identity-verifications/ https://blog.google/products/google-pay/google-wallet-age-id... [1] https://news.ycombinator.com/item?id=43863672 https://news.ycombinator.com/item?id=43863672

bfg_9k 1y ago

What an absolute clown show - the EU fines Google and Apple for being monopolistic and abusing market power and then proceed to implement apps like these that can only be used on American operating systems. Seriously you can't make this stuff up.

tonis2 1y ago
Yeah, EU byrocrats love corporate overlords in real life
stephen_g 1y ago
I mean there's a perfectly rational possible explanation for this - if the fines are actually just an extra targeted tax on these companies (but it's politically inconvenient to just do it honestly by levying a tax), and they would therefore adjust the laws to make sure they could still fine them if they had already complied... It may be that the people in charge in the EU don't really care about the market dominance as long as they can collect enough extra money from them...

avidiax 1y ago

For those wondering what the purpose is: https://ageverification.dev/Technical%20Specification/architecture-and-technical-specifications/#23-user-journey https://ageverification.dev/Technical%20Specification/archit... https://ageverification.dev/Technical%20Specification/media/Figure_1_user_journey.png https://ageverification.dev/Technical%20Specification/media/... Essentially, the core user journey is a privacy preserving "over 18" check. I suppose this prevents under 18's from accessing porn, in the same way that most blocking technologies impose an expense on everyone but fail to block tech-savvy children. Doesn't seem like it could ever stop someone with a bittorrent client, unless you have to attest you are over 18 to even use bittorrent.

GaggiX 1y ago
>but fail to block tech-savvy children. If I were a kid, I could see myself downloading Opera GX and enabling the free VPN. It's probably not "tech-savvy" because the browser gets a lot of ad views on YouTube; it would be pretty obvious.
- avidiax 1y ago
  Or using a torrent. Or trading a fileshare with your friends. Or finding a box in the woods. Or finding dad's "tax returns" folder. Or getting on TOR. Or finding an open directory. Or asking AI to produce something. Basically anything other than going to a legally compliant website and trying to attach your mom's passport to the age verification app and doing the challenge.
  - lotsofpulp 1y ago
    > Or finding dad's "tax returns" folder. I would want to sit in on this audit.
    - SauciestGNU 1y ago
      Are you coming onto his dad?
1y ago

avidiax 1y ago

Lengthy GitHub issue about this: https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/issues/10 https://github.com/eu-digital-identity-wallet/av-app-android... It really seems like tying this to Google violates some key principles of the EU market.

tetris11 1y ago

I guess GDPR is on the way out, unless Google pinky promises to keep all processing/data local to each EU state?

wmf 1y ago
What if the data stays on the phone?
- deleted 1y ago
  [deleted]
antonvs 1y ago
The GDPR data locality requirement is that personal data must remain in the European Economic Area (unless an exception applies.) It has no requirement that data remains local to each state. That's easy for a company like Google to comply with. In fact the company I work for uses Google European data centers to comply with GDPR.

potato3732842 1y ago

If you're wondering what regulatory capture looks like, this is it.

wmf 1y ago
It's more likely to be laziness by the developers.

reactordev 1y ago

Asking my EU friends, why do you let yourselves be bamboozled by the US tech companies when you’re totally capable of doing it yourselves? Seriously. You don’t need Google. You just need a plan and a will to execute.

amelius 1y ago
You need a pile of money first. And that works differently in the EU.
- reactordev 1y ago
  You have sovereignty of the EU and nations willing. Don’t say it will take money. Money is fake. You can do this. Everyone’s ready. The only reason US is wealthy is those subscription fees and vendor lock in we have.
  - amelius 1y ago
    They will be sued by Google for illegal state aid.
    - globalnode 1y ago
      who cares, money is fake (as stated above), pay the fines and move on with an EU OS
    - reactordev 1y ago
      Cool, in what court? EU court? It would be the EU doing this. Want to do business in the EU, GDPR extends to giving us the keys as well if you’re going to valet park here. Or they can go kick rocks while smart engineers in member countries build a new android. After all, a lot has changed since someone decided to bolt Java onto a Linux kernel.
      - anticensor 1y ago
        ICJ?

latentsea 1y ago

Ugh. There's just no winning with tech anymore. I use GrapheneOS as a daily driver and I absolutely love it. It should be the default. There's already one app I use that must do something similar and absolutely just won't run on it, so I have an entirely separate phone running stock Android just for that one app. Still worth the hassle. Glad I don't live in a place where all this madness is taking root, but still, the trend itself sucks.

superkuh 1y ago
The only winning move is not to play the game. One has to have a phone these days but you don't have to do your computing on it (during personal time). Use a real computer instead.
- latentsea 1y ago
  Great advice that I just can't take.
- IlikeKitties 1y ago
  > I would like to pay for goods and services online. > Very well sir, which digital payment service would you like to use? > It doesn't matter they all force me to use my phone.
  - ranyume 1y ago
    It's pretty crazy. You can be authenticated on a website, and the website still asks you to use your phone to.. validate what you're doing on the pc.
- Aachen 1y ago
  This software doesn't run on a real computer. The point of the submission is that it only runs on a DRM device from two entrenched vendors
  - superkuh 1y ago

titanomachy 1y ago

Without getting into the ideological weeds too much, is there a solid technical reason for this? Like if this verification wasn’t in place, could I just alter the source code or binary to always return “yes I’m 18” (or whatever) and completely subvert the intent of this tool? If so, is there a straightforward way to prevent this without involving Google?

fluidcruft 1y ago
I'm pretty sure all you need is the ability to login to a website and for that site to vouch for your age based on having examined your identification documents (or something like a network of PGP web-of-trust type notaries). I have a hunch that using a hardware token and biometrics is required to prevent fraud (FIDO and passkeys etc should work). The trick is preventing simulated tokens from existing/working which is where secure boot etc enter the picture.
- Aachen 1y ago
  Can you clarify what fraud you're thinking the "secure boot" (which I take to mean: being denied the access to control your own device) would prevent? Since the identity documents you already have, have this chip that works the same as your bank card, you really don't need a relaying party (your phone, your ISP, etc.) to be trusted for the receiving website to be able to verify the cryptographic signature on the data
  - fluidcruft 1y ago
    Fraud would be someone who is not you using your identity.
    - Aachen 1y ago
      So the scenario this is needed for, is where someone does a physical and technical attack on your phone just to extract the key from this app that says you're 18+. That would be why nobody can have access to their own data anymore I'm sorry but that cure is definitely worse than the disease. This is not an attack you see outside of spy movies

Edmond 1y ago

There is a correct cryptographic solution for information verification online: https://news.ycombinator.com/item?id=43715884#43722778 https://news.ycombinator.com/item?id=43715884#43722778

deleted 1y ago

[deleted]

lern_too_spel 1y ago

No evidence is given that they won't implement non-Google remote attestation solutions like https://attestation.app/about https://attestation.app/about Indeed, the bug links to another bug where the author says that it isn't restricted to Play Services remote attestation and recently followed up with a documentation update making that clear. https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui/issues/287#issuecomment-3084857018 https://github.com/eu-digital-identity-wallet/eudi-app-andro...

saubeidl 1y ago
No evidence is given they will.
- lern_too_spel 1y ago
  You replied after I had updated the comment to provide said evidence. Adding to what I said earlier, this isn't even an app that any EU member state will use. It's just a PoC, as it says in the README. https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui https://github.com/eu-digital-identity-wallet/av-app-android... Unfortunately for the authors, the pitch forks are already out, and the mob is on the march. It's too bad that HN is contributing to it.
  - antonvs 1y ago
    It's good that there are strong reactions to dystopian work like this. It's solving a problem that doesn't need to be solved using a solution that's fraught with risks. The authors chose to spend their time helping governments censor information, removing choice from individuals, and the solution they choose to work on is a bad one. Any criticism they receive is well-deserved.
    - lern_too_spel 1y ago
      There are already age check requirements to do things like buy liquor online. Today, that requires uploading your ID, so the service provider gets a lot more information than just that you're above a certain age. The existence of this new way to prove your age without giving away a bunch of other information does not "[help] governments censor information" in any reasonable way.

lemoncookiechip 1y ago

We shouldn't need Age Verification checks for adults in the first place. Create a better, standardized, open-source parental control tool that is installed by default on all types of device that can connect to the web. The internet aspect of the parental control should be a "Per Whitelist" system rather than Blacklisting. The parents should be the ones to decide which domains are Whitelisted for their kids, and government bodies could contribute with curated lists to help establish a base. Yes, there would be some gray area sites like search engine image search, or social media sites like Twitter that can allow you to stumble into pornography, and that is why these devices that have the software turned ON, should send a token through the browser saying "Parental Control". It would be easier for websites to implement a blanket block of certain aspects of their site than expect them to implement whole ID checks systems and security to make sure that no leaks occur (look at the TEA app) like the UK is expecting everyone to do. Also, I'm for teenagers (not little children) having access to pornography. I was once a teenager, every adult was, and we know that it's a natural thing to masturbate which includes the consumption of pornography for most in some way. Repressing their desires, their sexuality, and making this private aspect of their life difficult isn't the way. Yes, yes, there is nuance to it, (very hardcore/addiction/etc) but it should be up to the parents to decide with given tools if they trust their kid to consume such a thing. As for the tool itself. Of course we have parental tools, but they can be pretty garbage, their all different, they're out of the way, and I understand that many people simply don't know how to operate them. That's why I believe that creating a standardized open-source project that multiple governments can directly contribute to and advertise for parents is the way, because at the end of the day, it should be up to the parents to decide these things, and for the government to facility that choice. Obviously, besides the internet aspect, the tool should have all the bells and whistles that you'd expect from one, but that's not the topic. EDIT: And yes, some children would find a way, just like they're doing now for the currently implemented ID checks. It's not lost of me that VPNs with free plans suddenly exploded in 4 digits % worth of downloads. A lot of those are tiny people who are smart enough. Or using an app like a game to trick Facial Recognition software.

mk89 1y ago

I am not sure if I am more disturbed by the user journey they want to introduce for accessing websites or the fact that a private company (american, chinese, I don't care) has to become the gatekeeper to let me in. Who the hell wants this Internet...?

heavyset_go 1y ago
> Who the hell wants this Internet...? Scared rich people and bureaucrats
IlikeKitties 1y ago
> Who the hell wants this Internet...? The under educated, unthinking unwashed masses. Just look at the tea leak. The amount of people that do not care about freedom or privacy on the internet vastly outnumber those that do. And because they do democracy unmasks itself in the digital realm as the tyranny of the unthinking majority. Weep for the future.
ranyume 1y ago
The lazy middle class who don't like to take the responsibility of actually contributing to their community and running their family. ps: Had to add this post after the others identified the low class and the upper class as responsible for this ;). But depending on where you are, the low class might not be "the masses".
clarionbell 1y ago
Well meaning nordic liberals? They have been pushing chat control, I assume this is their idea as well.
_0ffh 1y ago
Politicians and their buddies scared of having lost control of mass media.

marcinzm 1y ago

Looks like someone just got a really cushy job at Google when they retire from leading this system.

exabrial 1y ago

Lol. People put way too much trust in governments. If it's not unbelievably obvious, there's an entire class of people flying private jets to "world summits" where the transcripts aren't disclosed. What do you think is going on? Use your brain.

johnisgood 1y ago
I don't know why people on here love the Government. They are probably advocating for a Government, but not this. A government that does its basic functions, without too much overreach, something like minarchism.

0x_rs 1y ago

The war on the free internet is accelerating. Without real push-back to these dystopian laws and consequences for the people proposing and lobbying for them, you'll miss what will ultimately end up being a temporary anomaly of mostly unrestrained free flow of information. It's not an hypothetical scenario or something that will develop down the line, it's happening today, worldwide.

quantummagic 1y ago
They always start with "think of the children", but that's just the opening salvo. The wild west days of the internet are definitely behind us. We'll be lucky if we still have private personal computing in the future, or any semblance of free speech.
- akersten 1y ago
  If we're to regain any ground here we need to adjust the messaging wrt terms like "wild west" - that's precisely the kind of terminology that scares the average voter into thinking the government needs to do something about this whole internet thing. We need to use patriotic and inspiring language, like "free" as in "free speech for the internet," or "safe and private" etc
- pixxel 1y ago
  [dead]
RpFLCL 1y ago
I heard from a friend last night that they were unable to see posts on X about current protests in their country because those were considered "adult" content which can now only be viewed after submitting to an ID check. Not porn, video of a protest. You're 100% right that it's happening today.
- stinkbeetle 1y ago
  Sadly the old guard of free speech and privacy activists on the internet has long gone, drowned by a sea of unprincipled populist reactionaries - if their team decided that the content is "problematic", then they are entirely justified in censoring and punishing the speakers for daring to speak it, and entirely justified in protecting everybody else from having to suffer the horror of reading/seeing/hearing it, and it matters not whether the mechanisms are legal or ethical because the ends justify the means.

snickerbockers 1y ago

The European union never ceases to amaze me. Whatever happened to becoming less dependent on American corporations? They flip flop on this stuff at least once a month, and the most annoying part is that they always herald everything they do as some new epoch-defining initiative only to quietly forget about it and do the opposite a few months later. If nation states are dogs, then EU is the chihuahua: loud, proud and extremely ineffective.

alephnerd 1y ago
> They flip flop on this stuff at least once a month Because in the background it's a French vs German vs Irish vs Czech vs $insert_eu_state business interests competing with each other. Notice how it's almost always French legislators and businesses that mention "domestic EU tech" and not Polish, Czech, Romanian, Dutch, or even German policymakers or businesses? That's why. National interests always end up trumping the EU in it's current form. And for a large portion of the EU, American BigTech represents the majority of FDI (tech and overall). Japanese and Korean automotive players did the same thing with the US in the 1980s-90s in order to ensure their interests remained aligned (though the Plaza Accords did play a role)
- BLKNSLVR 1y ago
  France has some history in being disappointed by the US, so it doesn't really surprise me that France is beating the independence drum the loudest. https://www.youtube.com/watch?v=Px9qhDGv300&t=150s https://www.youtube.com/watch?v=Px9qhDGv300&t=150s. (the entire video is interesting and informative, I've skipped it to the France-US specific part, up to about 11:02 where Australia is introduced as the US sycophant it is) Whether it's logical or not, offences past, even those thought forgotten, are easily recalled when under similar pressures.
  - alephnerd 1y ago
    > Whether it's logical or not From an American NatSec perspective, French strategic autonomy is viewed as a positive, as can be seen with Elbridge Colby's work (and similar work by Mastro and Doshi), and a lot of the initiatives led by the Biden admin, as this would allow burden sharing because the US is no longer in a position to manage a two continent war. France does our dirty work in the Sahel and can help in the Indo-Pac (as was seen with the US, France, and India jointly armtwisting the UK into ceding Diego Garcia to Marutius) In Australia's case (and to the US's benefit), alignment with France makes sense and has been something that has come up in Australian NatSec for years. New Caledonia is barely 800 miles off the coast of Australia and NZ, and both New Caledonia and French Polynesia have faced pressure due to China, especially after the recent violence in New Caledonia was linked to Azeri [5] disinfo networks on TikTok, along with decades of covert ops by China in New Caledonia [6][7]. France has also been an active defense partner with India and Indonesia - both of whom are increasingly cornerstones of Australian defense. By every single standard, having an active "Indo-Pac" France is a net benefit for America+ strategy and Taiwan. That said, French NatSec "strategic autonomy" does not have anything to do with French industry's alignment with marketing a "European first" tech story. France has similar issues to the US with power politics (as can be seen with France, US, SK, and Israel sharing a similar CPI score), and the biggest booster and beneficiary for "European Tech" is Xavier Niel [0] (France's Mark Cuban or Elon Musk), who is on a first-name basis with Macron [1][2] and whose Father-in-Law (Bernard Arnault) has personally played a significant role in French power politics for years [3][4]. Arnault is also the reason why every country negotiating with the EU ALWAYS tariffs congac and champagne - Arnault's LVMH owns Hennessy and all the other congac producers, and the majority of champagne producers. End of the day, this is just another inter-elite conflict between vested business interests like any other, but couched with the flag of nationalism. Nothing wrong with that, but this is why you don't see alignment amongst EU member states - as each state is supporting their own vested business interests amidst a trade war. For example, there's a reason all of us American tech investors end up working with the same handful of politically aligned law firms in Czechia or ending up in the same IT Parks in Eastern Europe. [0] - https://www.bloomberg.com/opinion/articles/2025-02-12/xavier-niel-s-not-ready-to-throw-in-the-towel-on-ai https://www.bloomberg.com/opinion/articles/2025-02-12/xavier... [1] - https://www.lemonde.fr/en/politics/article/2024/12/22/emmanuel-macron-s-art-of-secrecy_6736366_5.html https://www.lemonde.fr/en/politics/article/2024/12/22/emmanu... [2] - https://www.bloomberg.com/news/articles/2018-05-22/french-mindset-shift-under-macron-poised-to-boost-startups-levy https://www.bloomberg.com/news/articles/2018-05-22/french-mi... [3] - https://www.reuters.com/business/media-telecom/insight-macron-moguls-inside-fight-over-french-fox-news-2020-12-17/ https://www.reuters.com/business/media-telecom/insight-macro... [4] - https://www.lemonde.fr/en/economy/article/2023/08/08/bernard-arnault-and-the-most-powerful-address-book-in-france_6085516_19.html https://www.lemonde.fr/en/economy/article/2023/08/08/bernard... [5] - https://www.aspistrategist.org.au/russia-azerbaijan-exploit-new-caledonian-strife-against-france-china-stays-mum/ https://www.aspistrategist.org.au/russia-azerbaijan-exploit-... [6] - https://www.aspi.org.au/report/when-china-knocks-door-new-caledonia/ https://www.aspi.org.au/report/when-china-knocks-door-new-ca... [7] - https://www.lemonde.fr/en/pixels/article/2024/05/16/why-and-how-tiktok-was-banned-in-new-caledonia_6671655_13.html https://www.lemonde.fr/en/pixels/article/2024/05/16/why-and-...

nabakin 1y ago

Unfortunately this isn't the first time a government has banned Android devices which are not licensed by Google. GrapheneOS has a list of them[1] [1] https://grapheneos.org/articles/attestation-compatibility-guide#apps-banning-grapheneos https://grapheneos.org/articles/attestation-compatibility-gu...

pfoof 1y ago
For Authy I don’t even feel sorry. Proprietary TOTP. sorry for off-topic
preisschild 1y ago
The Austrian ID App was also blocking GrapheneOS due to SafetyNet verification... After a lot of angry emails towards the helpdesk, they at least changed it, so a failed check only shows a warning that you can accept.

Arch-TK 1y ago

It's absolutely abysmal that the EU and UK are implementing laws relating to age verification requirements. Who voted for this? Who asked for this?

johnisgood 1y ago
The whole Chat Control crap is bullshit no one asked for, and unfortunately many countries in the EU are in favor of it. There is a map somewhere that shows the countries that are against it, I cannot find it right now.
- nickslaughter02 1y ago
  https://www.patrick-breyer.de/wp-content/uploads/2024/12/signal-2024-12-11-152711-002-2.jpeg https://www.patrick-breyer.de/wp-content/uploads/2024/12/sig...
  - johnisgood 1y ago
    Yes, that, although I wish they made a distinction between abstain vs. opposed.
    - nickslaughter02 1y ago
      Updated after the last meeting: https://digitalcourage.social/system/media_attachments/files/114/946/559/217/657/887/original/a741ac2bcf13f1c9.png https://digitalcourage.social/system/media_attachments/files...
luke727 1y ago
Unfortunately many more people than you might think are in full support of this type of thing. The UK in particular is a very nanny state and this is sold as protecting children. You're not against protecting children, are you?
- johnisgood 1y ago

FpUser 1y ago

Sure, so much for freedom of choice and twisting people's arms. What is it their fucking leaders sing about being freedom loving and democratic?

motohagiography 1y ago

"age verification app," is such a phony pretext. They know that android fragmentation and the lack of consistent verifiable hardware is what prevents govts from implementing a punitive digital ID that is sufficient to punish and fine people using western standards of evidence and legal defense. these people are monsters. don't help them, and don't be complicit. working on digital ID tech, and even disclosing vulns in it is like helping Hollerith make faster and more efficient punch cards.

bluecalm 1y ago

Funny how EU politicians complain about dependency on American tech and the next day do something like this. It's all cheap talk anyway as they have 0 intention to make EU based alternatives possible but it's rarely in your face so much.

perching_aix 1y ago

This collision course has been a long time brewing, though I'm not even sure why integrity checking is included in this. The data source for the age information is the governments, there's no need to trust the clientside per se, it's just a middleman. One thing I find reassuring is the nature of pushback on display on the repo (only read the first few comments there, mind you). Really not what I expected phrasing and rhetoric wise (unlike here), honestly kind of restored a very very tiny and fragile bit of faith in humanity in me, it's very reserved and reasonable stuff.

yupyupyups 1y ago

This has nothing to do with age verification, but everything to do with identifying users on various services. They can compell the providers of said services to give them access to how each, now identified, user is using the service. Since a lot of our lives are digital, this is a major transfer of power from the people to a select few. A question I have is who voted for this? I sure didn't.

ranyume 1y ago
It's called representative democracy and it's been in crisis for some years now.
- dekken_ 1y ago
  It's so indirect it's hard to even consider it a form of democracy. I don't.
- Saline9515 1y ago
  The European Commission is unelected. The European parliament can't choose which laws it wants to vote on. This is a simulacrum of democracy.
lern_too_spel 1y ago
> They can compell the providers of said services to give them access to how each, now identified, user is using the service. The whole point of this is that they can't, which is unlike the systems they had used before. The only information that the service provider receives is that an age check has passed.

hnpolicestate 1y ago

The problem isn't being handcuffed by Google or an American company, it's being handcuffed at all. Is it some kind of psychological coping skill to misdirect from the obvious problem (an age verification app that bans user software preferences)? Who cares if it's Google or an American company. The point is you decided to let the E.U dictate what software you can run on your phone.

jajuuka 1y ago

I think this misses the forest for the trees. I could care less if the app requires a Google Android phone or non-jailbroken iPhone to work. I care that age verification exists in the first place, when it most definitely shouldn't. Arguing and ranting about how a huge privacy compromise functions misses the point that privacy is being compromised. It's just odd to see them bringing up America when their own government created this. Not the US. How about fight the actual problem instead of making sure the problem works on more devices.

scarface_74 1y ago

I never want to read about how the EU “cares about people’s privacy” unlike the evil US

johnisgood 1y ago
Neither cares about privacy, to be honest.

glitchc 1y ago

I wonder if this requirement stemming from the recently announced trade deal with the US.

progval 1y ago
It's not. You can look at the Git history, it was added two months ago: https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/commit/15073d7059bcf9d1496a3ec294541bd55ce262e9 https://github.com/eu-digital-identity-wallet/av-app-android...

BLKNSLVR 1y ago

What "things" are going to depend on this Android-locked age check? What about Apple users? What about accessing it via a laptop or desktop (shock horror: running Linux!)? My dad gets by in his "my dad" way of life without a mobile phone at all, I wonder how much longer this will be possible. I was about to rant about being forced to have a mobile if you want to participate in society, but then he uses a desktop for some of the services for which the rest of us use a mobile, so my rant falls down in that, for a while now, to participate in society you've needed either a computer or a mobile. Hopefully computer-only can eke out some kind of base-adequate participation for a while longer.

jeroenhd 1y ago
iOS also be supported and will use Apple's remote attestation capabilities. But, as there are no real alternative ROMs for iOS devices, only Android users are really affected by this. From a legal point of view, the app should be a reliable convenience feature and not replace traditional (physical) identity verification. How much your dad will be affected will depend on how shitty and lazy the services he uses are. If he doesn't use a phone or a computer, he probably won't notice the difference.
Aachen 1y ago
You can also buy an Apple device but that was never your device to begin with so nothing is lost when the EU requires Apple to be the only party with the capability to modify what your device can run

danielscrubs 1y ago

Any EU friends can tell me which politicians are behind this?

WhereIsTheTruth 1y ago

Europeans, fighting for European sovereignty, bowing down to Google and Microsoft How sad is that, Europeans, you have fallen this low

hulitu 1y ago

> EU age verification app to ban any Android system not licensed by Google Oh, so now we know who is pushing for age verification. FAANG

jonathanstrange 1y ago
They're pushing for anything that makes their services essential and indispensable for every citizen, and thereby locks all future competition out.

pabs3 1y ago

A URL without requirement to login to Reddit: https://old.reddit.com/r/degoogle/comments/1mau7yl/eu_age_verification_app_to_ban_any_android_system/ https://old.reddit.com/r/degoogle/comments/1mau7yl/eu_age_ve...

MrDresden 1y ago

The title of the submission is misleading. The linked Reddit discussion is about the issue of attestation in the EU age verification application requiring a licensed version of Android to function properly. The EU is not banning non licensed Android systems. This would make it hard for EU citizens to use those though, if they need that app.

elric 1y ago

I'm getting pretty tired of the EU trying to shove internet-crippling regulations down my throat. This, along with ChatControl, is clearly a path towards totalitarian control. Who are the politicians making these decisions? How did they get elected? Did anyone vote for Totalitarianism 2.0?

Oras 1y ago
Governments are reflection of their people, like it or not.
- elric 1y ago
  Are they, though? The people don't elect the European Commission. The European Council selects candidates and the European Parliament can vote for them. The people in the European Parliament are often politicians who no one knows but sort of vote for because they're associated with their preferred party. I don't recall any party campaigning on reducing internet freedoms.
Llamamoe 1y ago
Politicians are all that stands between corporations and absolute corruption. It's why they're both their primary target and the ambition of greedy people.
lern_too_spel 1y ago
> I'm getting pretty tired of the EU trying to shove internet-crippling regulations down my throat And I'm getting tired of people pulling out pitchforks without reading anything. This is how democracies end up electing people like Trump. There are no regulations to require age verification here. The EU is simply giving guidelines for implementing harmonized age verification across the EU if any member states or companies that do business in the EU want to use it instead of making people scan ID cards like they currently do and making the receiver of said scans have to understand updates to the designs of the various ID cards used throughout the EU.
- elric 1y ago

renewiltord 1y ago

I know you can’t access the Internet but at least you can use USB-C. Europe LOL!

redbell 1y ago

The first comment was hilarious: "so how does one report the EU for breaching GDPR" and it reminds me of a comment on r/androiddev where Google was requiring solo devs to have a verifiable phone number for support and the commenter said something like: "Meanwhile, Google itself do not have a support phone number for his Android devs!"

Traubenfuchs 1y ago

Will this be the end of kyc companies like veriff, onfido, jumio, trulioo and whatever else is this crowded space in europe? Will people sign up to banks and betting apps with their eu wallet digital identity?

deleted 1y ago

[deleted]

jruohonen 1y ago

A lot of discussion, but one contradiction seems to have gone unnoticed; notably, the EU's DMA decision about Apple having to allow alternative app stores. Go figure again about these contradictory moves.

trklausss 1y ago

EU: "We need to decouple from the independence of the US". Many (local and national) entities proceed to ditch Microsoft for it. Also the EU: Well if you don't have a Google or Apple account you are not getting age verified.

ozgrakkurt 1y ago

Wow, kids are installing random operating systems from internet into their phones right?

frafra 1y ago

Play Integrity API requirement dropped: https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui/commit/9367289f3da1abd7f2cff0e7e05d67a95f4fdf60 https://github.com/eu-digital-identity-wallet/eudi-app-andro...

its-summertime 1y ago
That is a different repo
- lern_too_spel 1y ago
  That is the repo that this PoC is forked from.
  - its-summertime 1y ago
    even if changes were pulled from that repo, they wouldn't make it into the downstream repo as that file has been near completely replaced, not that it is a change of anything more than a line of text in a readme

chmod775 1y ago

At the end of the day someone could always grab this code, remove the verification step, and distribute that as a new app.

no_time 1y ago
That "someone" doesn't understand how hardware backed platform attestation works. The wikipedia page does a pretty good job at explaining it: https://en.wikipedia.org/wiki/Trusted_Computing https://en.wikipedia.org/wiki/Trusted_Computing
- chmod775 1y ago
  Yes, they do. There's nothing in the spec this app implements that actually requires that step. The app just chooses to do it in this case. Or rather is planning to. Right now it doesn't even have that integrity check, despite fully implementing the verification flow.

pastage 1y ago

You can't use device verification in production anyways. (ATM) This has no effect, is it even used in production anywhere? It seems to be part of eIDAS which is a good thing, most countries already have their own identity systems as is stated in the README. The three or for id apps I have seen all have some kind of device check that is sent to the ID provider, it is not usually accisible for ServiceProviders though. On those apps you either get no indication or just a "seems suspicious" score. The one in Sweden has a "return risk option". https://developers.bankid.com/api-references/auth--sign/auth https://developers.bankid.com/api-references/auth--sign/auth This does not make it possible to filter out people. And honestly considering the amount of shady phones people have I am not sure this will every work. Apple is sadly another issue, too many normals there. It is nice that this is pointed out so we do not get a distopian future.

jonathanstrange 1y ago

This is ridiculous but it's worth pointing out that if the EU would provide their own infrastructure for "age verification" it would be even more Dystopian. The problem is not really that the EU in this case would give Google and Apple monopolies that locks out all competition, the problem is the "age verification" itself. Nobody needs, nobody wants it, and it's the starting point for all kinds of browsing and chat control measures dictated by governments.

OhioMan2943 1y ago

All by design :)

ribcage 1y ago

[dead]

zoobab 1y ago

With the vassalisation of the EU, this is yet another prof that the European Commission and some other countries follow what the US wants. Bad deal all along.

rdm_blackhole 1y ago

A while ago, when the topic of the EU digital ID was brought up, I said clearly that this was going to be shit-show and that the intent was going to use this as tool to muzzle the population. It turns out I was right. This is the intent. First require digital ID to access content/post anything on social media, then make it impossible to use said ID outside of the walled garden of Android and Apple, then tie this digital identity to your real world ID and make sure it can be revoked at anytime by the powers that be. Bonus point, make sure everything you say or do is stored for unlimited access by law enforcement to protect the democracy(TM) or protect the children(TM). If that is not a slippery slope, then I don't know what it is. I also pointed out that creating a database of everyone in the EU containing a lot of PII in terms of religious preferences, sexual preferences and so on is a the stupidest idea that anyone could have considering that this tool could be used by the next parties in power to hunt down political/religious opponents. Nobody can say that they did not know.

phtrivier 1y ago

I don't understand how the poster of the message goes from the disclaimer tet: > The current release provides only basic functionality, with several key features to be introduced in future versions, including: > - App and device verification based on Google Play Integrity API and Apple App Attestation > - Additional issuance methods beyond the currently implemented eID based method. > These planned features align with the requirements and methods described in the Age Verification Profile. to the "In the case of Android, genuine means"... I don't see the word "genuine" in the disclaimer. Is that a necessary part of using the "Google Play Integrity API" ? (I'm genuinely asking, I feel like I'm missing some implicit context here.)

SpicyLemonZest 1y ago

I don't understand what device verification is even meant to do here. What's the threat model of a child who knows how to root their phone and defeat verification checks manually but doesn't know how to find an adult to create an account and give them the password?

Ray20 1y ago
It is to create an infrastructure for global surveillance and control of all citizens.

okokwhatever 1y ago

Internet has become a commidity that needs to be reinvented with a focus in the real human interactions and the privacy. How?, who?, Where? I'm afraid it is too late to find a group of people interested in creating a real network outside of the system. The best that i found was the LoRa communities but are useless for anyone submerged in the Tiktokian distopy.

nicman23 1y ago

who do we contact for this mess?

invig 1y ago

This is a problem that needs to be solved. I guess we should have solved it before the regulators got involved, alas, here we are.

evanjrowley 1y ago

Wouldn't this be in direct conflict with the DMA?