4 ms·
I'm pretty sure all you need is the ability to login to a website and for that site to vouch for your age based on having examined your identification documents
by fluidcruft 1y ago
I'm pretty sure all you need is the ability to login to a website and for that site to vouch for your age based on having examined your identification documents (or something like a network of PGP web-of-trust type notaries). I have a hunch that using a hardware token and biometrics is required to prevent fraud (FIDO and passkeys etc should work). The trick is preventing simulated tokens from existing/working which is where secure boot etc enter the picture.
- Aachen 1y agoCan you clarify what fraud you're thinking the "secure boot" (which I take to mean: being denied the access to control your own device) would prevent? Since the identity documents you already have, have this chip that works the same as your bank card, you really don't need a relaying party (your phone, your ISP, etc.) to be trusted for the receiving website to be able to verify the cryptographic signature on the data
- fluidcruft 1y agoFraud would be someone who is not you using your identity.
- Aachen 1y agoSo the scenario this is needed for, is where someone does a physical and technical attack on your phone just to extract the key from this app that says you're 18+. That would be why nobody can have access to their own data anymore I'm sorry but that cure is definitely worse than the disease. This is not an attack you see outside of spy movies
- fluidcruft 1y agoYubikeys go on your keychain. You're as likely to not notice losing it as you are your housekeys. Anyway the point is that if you're not willing to run a trusted phone, there are other very viable options... particularly for technical folks who tamper with phone software... and those who cares about the Google panopticon... that are extremely viable and should be acceptable to satisfy the stated intent of the regulation.