3 ms·

It's even more restrictive than than, for age verification you only get back whether the person is above the age limit or not, it's a boolean response. So I th

It's even more restrictive than than, for age verification you only get back whether the person is above the age limit or not, it's a boolean response. So I think from that view the eID works pretty well, it provides the minimal necessary information. The bigger issue with something like this is if you use them to enforce real name policies or stuff like that.

hsbauauvhabzb 1y ago
That still results in the government knowing you connected to that website though. Edit: unless there’s a blind middleman that has tight data policies?
- number6 1y ago
  I think it does not know. The app is open source and it just sends the Boolean. The government just gives out the id cards - they are not involved in the verification process
  - Hamuko 1y ago
    I know the whitelabel EU app is open source but are the derivatives going to be? As far as I understand it, every EU country will release its own version of the app.
    - number6 1y ago
      I am talking about the German AusweisApp: https://github.com/Governikus/AusweisApp https://github.com/Governikus/AusweisApp
    - subscribed 1y ago
      And it's actually a good thing and not bad. EU version explicitly requests Google or Apple attestation, which at least on Android is astonishing overreach, since theres Hardware Attestation API that can confirm the platform integrity better (instead of confirming old, unpatched handsets with leaked keys are secure, LOL). Hopefully some countries will do it the correct way.
- raron 1y ago
  Not really (as far as the website and the government doesn't collaborate and share information with each other). AFAIK the EU age verification app works by requesting bunch of digitally signed "proof of age" tokens (openid verifiable credentials) from a government institution and sends (uses up) one when you want to prove your age to a website. The website can check the validity of these tokens without connecting to the government institution. They are even trying to do some form of blind signature or zero-knowledge proof to have better protections. https://ageverification.dev/av-doc-technical-specification/docs/architecture-and-technical-specifications/ https://ageverification.dev/av-doc-technical-specification/d... Age verification laws are easy to circumvent and they are bad for many other reason though.
danaris 1y ago
...Unless the government is specifically looking out for this, that's easy to game by just submitting a bunch of requests for age validation with incrementing ages. Is that worth it? No idea—but I'm willing to bet some surveillance advertisers think it's worth it.
- Sayrus 1y ago
  I haven't read the spec so I'm not sure if you can request that or only 18+. However doing dozens of requests requires the user's approval each time which may raise red flags and I can imagine your certificate revoked.
progbits 1y ago
Presumably the request contains some nonce, otherwise this is trivial to replay? But even then, I can volunteer my ID, keep it permanently attached to a computer running a server that allows certain requests (like the boolean age check), and then provide an API / client that allows anyone anywhere to use it to pass. No risk to me (none of my data leaks), presumably no rate limits (the card has no way to track time; at best it could store recent request timestamps but I doubt it does). In fact even better, use stolen or lost cards. Owner will get a new one, but the old one has no way of knowing it's voided. We can build a network that is able to sign whatever info (age, gender, city, name) you want, as long as we have one ID with such info.
- deleted 1y ago
  [deleted]
- Seattle3503 1y ago
  It would probably be enough to stop an unsophisticated eight year old from seeing porn. If it turns out to be a real issue, we could figure out a way to implement pairwise pseudonyms, so that each ID has a pseudonym with each service that is unlinkable to other services. If you see a million requests from a pseudonym, that pseudonym probably an ID being abused and you can block it.
- ivan_gammel 1y ago
  >But even then, I can volunteer my ID, keep it permanently attached to a computer running a server that allows certain requests (like the boolean age check), and then provide an API / client that allows anyone anywhere to use it to pass. That’s not technical problem and it doesn’t have to be a technical solution to it. You will be committing fraud and maybe a few other crimes if underage users are involved. As soon as you will start advertising the service, you will be on law enforcement radar. Or maybe you don’t advertise it, but one of the boys using it will brag at school and get someone’s attention…
  - progbits 1y ago
    Yes and access to porn is not a technical problem. I don't see why my privacy is to be compromised because of incompetent parents.

hsbauauvhabzb 1y ago

That still results in the government knowing you connected to that website though. Edit: unless there’s a blind middleman that has tight data policies?

number6 1y ago
I think it does not know. The app is open source and it just sends the Boolean. The government just gives out the id cards - they are not involved in the verification process
- Hamuko 1y ago
  I know the whitelabel EU app is open source but are the derivatives going to be? As far as I understand it, every EU country will release its own version of the app.
  - number6 1y ago
    I am talking about the German AusweisApp: https://github.com/Governikus/AusweisApp https://github.com/Governikus/AusweisApp
  - subscribed 1y ago
    And it's actually a good thing and not bad. EU version explicitly requests Google or Apple attestation, which at least on Android is astonishing overreach, since theres Hardware Attestation API that can confirm the platform integrity better (instead of confirming old, unpatched handsets with leaked keys are secure, LOL). Hopefully some countries will do it the correct way.
raron 1y ago
Not really (as far as the website and the government doesn't collaborate and share information with each other). AFAIK the EU age verification app works by requesting bunch of digitally signed "proof of age" tokens (openid verifiable credentials) from a government institution and sends (uses up) one when you want to prove your age to a website. The website can check the validity of these tokens without connecting to the government institution. They are even trying to do some form of blind signature or zero-knowledge proof to have better protections. https://ageverification.dev/av-doc-technical-specification/docs/architecture-and-technical-specifications/ https://ageverification.dev/av-doc-technical-specification/d... Age verification laws are easy to circumvent and they are bad for many other reason though.

danaris 1y ago

...Unless the government is specifically looking out for this, that's easy to game by just submitting a bunch of requests for age validation with incrementing ages. Is that worth it? No idea—but I'm willing to bet some surveillance advertisers think it's worth it.

Sayrus 1y ago
I haven't read the spec so I'm not sure if you can request that or only 18+. However doing dozens of requests requires the user's approval each time which may raise red flags and I can imagine your certificate revoked.

progbits 1y ago

Presumably the request contains some nonce, otherwise this is trivial to replay? But even then, I can volunteer my ID, keep it permanently attached to a computer running a server that allows certain requests (like the boolean age check), and then provide an API / client that allows anyone anywhere to use it to pass. No risk to me (none of my data leaks), presumably no rate limits (the card has no way to track time; at best it could store recent request timestamps but I doubt it does). In fact even better, use stolen or lost cards. Owner will get a new one, but the old one has no way of knowing it's voided. We can build a network that is able to sign whatever info (age, gender, city, name) you want, as long as we have one ID with such info.

deleted 1y ago
[deleted]
Seattle3503 1y ago
It would probably be enough to stop an unsophisticated eight year old from seeing porn. If it turns out to be a real issue, we could figure out a way to implement pairwise pseudonyms, so that each ID has a pseudonym with each service that is unlinkable to other services. If you see a million requests from a pseudonym, that pseudonym probably an ID being abused and you can block it.
ivan_gammel 1y ago
>But even then, I can volunteer my ID, keep it permanently attached to a computer running a server that allows certain requests (like the boolean age check), and then provide an API / client that allows anyone anywhere to use it to pass. That’s not technical problem and it doesn’t have to be a technical solution to it. You will be committing fraud and maybe a few other crimes if underage users are involved. As soon as you will start advertising the service, you will be on law enforcement radar. Or maybe you don’t advertise it, but one of the boys using it will brag at school and get someone’s attention…
- progbits 1y ago
  Yes and access to porn is not a technical problem. I don't see why my privacy is to be compromised because of incompetent parents.