17 ms·
EU age verification app not planning desktop support
- deafpolygon 1y agoIt's a feature to force adoption into phones that are capable of tracking their users.
- emigre 1y agoThis is outrageous and doesn't make sense
- nicce 1y agoDepends on whom you ask. Google introducing the developer verification and sideloading on iOS being even bigger hurdle, they want to stay in control on what you use and they want to make sure you don't have possibility to use anything they explicitly permit. Normal desktop is unfortunately too open for that. Discourage people to use desktops and make rely on controlled gardens even more.
- throw834920 1y agoIt makes total sense. The whole point is to punish self-respecting people who use freedom preserving operating systems and treat them as second class citizens. See: https://news.ycombinator.com/item?id=44704645 https://news.ycombinator.com/item?id=44704645
- bilekas 1y agoThis is a great example of how this whole requirement hasn't been properly thought out. > Desktop support is not currently within the project's scope. What I would like to take from this is that, by their own definition, desktop apps are out of scope for Age Verification. So does that mean we will see a return of the 'desktop applications' instead of everything being a web service ? One can dream perhaps. Until then adults who are willing to 'do what they're told' will be the ones who are inconvenienced by this constantly. Edit: Also this will completely disable any new phone OS' being developed. Why would anyone bother when you can't verify your wallet to do anything online.
- Luker88 1y ago> oes that mean we will see a return of the 'desktop applications'...? No. It's still required by law, which means that your desktop application will require some interaction with your smartphone.
- cenamus 1y agoFurther forcing everybody to have their phone on person at all times
- pessimizer 1y agoI've been saying this for years: eventually not having your phone on you and powered up at all times will not be a crime, but it will be grounds for questioning and search. One day, there will be a knock on your door. "Good morning, this is the police. Is there something wrong with your phone? Is your phone broken? Can we provide you with a charge?" "No, I must have turned it off accidentally." "Can we assist you with an upgrade? The newer models don't have power buttons."
- Forgeties79 1y agoThe Pedestrian: https://xpressenglish.com/wp-content/uploads/Stories/The-Pedestrian.pdf https://xpressenglish.com/wp-content/uploads/Stories/The-Ped...
- sjw987 1y agoI think you're exactly right, and the groundwork is being laid today by the standards society is setting for everybody. People will assume a lack of phone or the presence of a phone but lack of usage / content on it, makes you guilty of some sort of crime similar to owning a burner phone. Tell somebody you use your phone less than 10 minutes a day and look at their face change.
- thewebguyd 1y ago> Tell somebody you use your phone less than 10 minutes a day and look at their face change. While not less than 10 minutes per day for me, but I was having this argument on reddit over the iPhone Air - people couldn't fathom that there's someone out there that is not on their phone 24/7, and doesn't use their phone as their main computing device. I clock in at under an hour screen time most days. It's the least ergonomic device for me to do anything remotely serious. Can't even stand typing on a virtual keyboard. My laptop is, and will remain, my main interface to the net and communication with others. You'd think I was some kind of weird hermit luddite because of it.
- baq 1y agoThis is hardware attestation in a nutshell: a double edged sword, and a sharp one at that. The biggest issue is that the attestation hardware and the application client is the same device with the same manufacturer, who also happens to have a slight conflict of interest between monetizing customers and preserving any sort of privacy. IMHO the pro-attestation forces are so overwhelming that we should all cherish the moment while we have anything open left.
- brookst 1y agoHow does private access token (PAT) compromise privacy in the name of monetization?
- qiine 1y agoThis could be a boon to all sorts of new kind of hardware though (wishful-thinking mode)
- disruptiveink 1y agoThe insane question here is, why would the EU mandate hardware attestation controlled by two private American companies in order to access services? That seems completely contrary to the spirit of EU laws and regulations, which tend to be about protecting the consumer, preventing monopolies, ensuring people can generally live their lives where all things that are mandatory are owned and ran by the state and foster a certain degree of EU independence, with a recent focus on "digital sovereignty". This one is a five for one against all of those goals? Harms the customer (you could see this as the polar opposite of GDPR), strengthens entrenched monopolies, force citizens to be serfs of one of two private corporations in order to access information, and on top of that, like it wasn't enough, willingly capitulates to the US as the arbitrates of who is a valid person or not. This is so against the spirit of the EU itself that it would almost be funny if people weren't serious.
- ronsor 1y ago> The insane question here is, why would the EU mandate hardware attestation controlled by two private American companies in order to access services? Because the EU doesn't actually care about privacy, otherwise they wouldn't be trying to do this and ChatControl. They care about being the main ones to spy on you, and maybe using fines as additional "taxes" on rich foreign companies. That's it.
- nickslaughter02 1y agoDo you want desktop PC vendors locking down hardware to enforce integrity?
- pjmlp 1y agoWant do you think Windows 11, latest macOS, ChromeOS hardware requirements are all about? CoPilot+ PCs even require the same security chip as XBox and Azure Sphere IoT board (Pluton), in addition to TPM 2.0. https://learn.microsoft.com/en-us/windows/security/hardware-security/pluton/microsoft-pluton-security-processor https://learn.microsoft.com/en-us/windows/security/hardware-...
- hhh 1y agoWell, yeah. There’s no way to curb the modern cheating epidemic without increasing security measures. Riot Games via Valorant truly pushed the industry so far ahead by reducing their cheating percentages so low that the cost to cheat for more than a few weeks at a time is thousands of dollars a month. It’s not the sole reason, but it’s a solid one.
- realusername 1y agoThey have some other secret sauce for sure, there's tons of cheaters on console which is a vastly more locked down platform compared to pc.
- realusername 1y agoI don't want integrity on my mobile so why would I want it on my desktop?
- zekica 1y agoExactly, remote attestation is only acceptable on your own devices with remote attestation servers that you control. For example, it would be completely fine to implement remote attestation where devices issued by companies to employees verify their TPM values with company's servers when connecting via VPN. All other such activities directly infringe on ownership rights.
- elric 1y agoAlong with chat control, it really seems like the EU is pushing a dystopian digital agenda.
- mono442 1y ago[flagged]
- Sharlin 1y agoSuuure, if the USSR had been a deeply neoliberal market economy. Something tells me you don't know anything about either the EU or the USSR.
- brookst 1y agoWhile I agree EU is nothing like USSR, calling it a market economy is kind of questionable. It’s a bit of a hybrid, which companies allowed to market and sell on their own but with intense regulatory control over product design. From USBC to ad supported business models, the EU has fairly tight control over how products are designed and monetized, in a way that I don’t think can be described as a pure market economy. Note that I’m NOT saying their level of centralized control and government specification of product requirements is bad. It’s a legit trade off and there are arguments that some or all of it is enlightened. But it’s certainly not a place where you just build your product and ship it and let the market decide.
- riffraff 1y agosince when a market economy need to have no regulation? Market economies are contrasted with planned economies, i.e. how prices are determined and production allocated, and the EU most decidedly is not that.
- brookst 1y agoSince when is “no regulation” the only alternative to bureaucrats defining minute product details that customers are perfectly capable of preferring with their wallet? Really, that was a very lazy false dichotomy.
- seydor 1y agoThis whole thing is good news for external hard disk manufacturers
- kome 1y agoso a smartphone is required by law? that's fucked up
- afandian 1y agoNo! Only required if you want to participate in society. And what gets me is that it's not just 'you need a phone', it's 'you need a Google or Apple account'.
- vaylian 1y agoAnd neither Google or Apple are EU-companies.
- lucb1e 1y agoYou don't only need the account, you need a phone that is locked down with hardware components and cryptographic keys that attest it hasn't been modified "unauthorizedly". Where the authority is not the device "owner" but Google, Apple, and the manufacturer The account would be easy enough with fake data and a 10€ prepaid one-time-use phone number. Finding an exploit in Android such that you can turn off Google's tracking but not trigger their "you modified your device" scans (that are to be tied to your government identity verification continuing to work) is a game I'm not looking forward to playing.
- userbinator 1y agoParticipate in a society, to be precise; at least in the US, the Amish seem to have created their own.
- deleted 1y ago[deleted]
- parasitid 1y agonot A smartphone: an iphone OR an android verified device. not your linux phone with waydroid or fairphone with lineageos
- jonbiggums22 1y agoWell, only smartphones made and controlled by American corporations that are subject to US laws.
- jmclnx 1y agoLets pretend the EU would mandate Desktop Support, we all know it will be only applied to Windows and Apple. Maybe for Linux, BSD it will never be applied. In anycase we all know ways of bypassing this age verification will be found, probably by the kids themselves. But all this will do is enable US big tech, killing the very EU based companies the EU has been crying about for years. Meta, Twitter, Google and M/S could not have created a better law to protect them then this law.
- irusensei 1y agoKids will bypass any verification by secretly using an adult ID or just straight away asking them to do it. Hell the crazy things I used to do to connect to the internet after my mother went to sleep. She didn't wanted me using the internet because of phone charges so I secretly got into the roof to strip the phone wire bare and connect my own hidden cable that I would unroll and route it to my room to connect to my modem at night. YES part of it was to watch porn and download mp3s and roms. No I wasn't of legal age. Did my life got ruined by this? Well I'm an IT engineer now so arrive at your own conclusion. I think this current hysteric moral panic is definitely being pushed by a lobby of a nascent AI industry that wants to create a problem for their surveillance tech solution.
- jmclnx 1y ago>Did my life got ruined by this? Well I'm an IT engineer Seeing you were on dialup, how board where you on dec 31, 1999? Me, I was up watching the systems work great, missing all the cool parties guzzling caffeine for 3 days. But it made managers happy for me to be there. If I tried that now, I would end up in the grave.
- irusensei 1y agoIt was more like in 2001 and there wasn't broadband yet in my country. I was a teenager so no caffeine needed to go over night. In fact I can still just stay awake just fine if I am distracted with some game or watching something. By the way I got hit by a considerable electric shock from that. By that time I had no idea phones carried enough tension to actually shock me.
- amelius 1y agoSomething tells me the granny on the bus can verify her age by going to the local service desk.
- snickerdoodle14 1y ago[dead]
- jeroenhd 1y agoMy experience with digitalisation is that the optional physical service desks quickly start disappearing once the younger generations start using digital equivalents. Card payments and digital banking have closed most bank offices outside the larger cities. Mail dropoff boxes are slowly dying out. Paper bank invoices now cost extra (an unreasonable amount extra). Granny may be able to verify her age, but the service desk won't necessarily be local.
- lucb1e 1y agoHere's the official Dutch government solution for if your mobile phone doesn't have NFC, if they don't support your phone's OS, or if they actively went out of their way to block your android distribution: "go ask for another person's device then" https://www.digid.nl/stappenplan/id-check-toevoegen-aan-de-digid-app/#1503 https://www.digid.nl/stappenplan/id-check-toevoegen-aan-de-d...
- lucideer 1y agoA lot of people outraged by this but ultimately this is good news - the more flagrant & public the technical incompetence of the people putting together these idiotic systems, the easier mass push back will be to foment.
- raincole 1y agoIt's not lol. The discussion has been shifted from "whether age verification should be a thing" to "how to implement a more convenient age verification system."
- sjw987 1y agoMass push back from whom? Most people don't care about this. They spend hours per day on a surveillance device, willingly contributing their data, personal information and media to monopolistic companies, including putting it into the public online sphere for the world to see. Many people are genuinely convinced this is about the safety of kids, even though the same workarounds slightly competent users know how to implement (VPNs) are the exact same tool the supposed evil-doers know how to use.
- bluecalm 1y agoIs there anything in the proposal to stop people from VPN'ing to a free country and access their porn from there?
- riffraff 1y agono, like there's nothing preventing you from getting porn via USENET. This has always been a "best effort" initiative that is unlikely to stop "dedicated" users.
- frizlab 1y agoI think they want to make age verification mandatory for subscribing to VPN services too.
- WithinReason 1y agoThen you subscribe to the VPN with a VPN
- Saline9515 1y agoYes, the EU will implement DPI and VPN restrictions in the futrue.
- jampekka 1y agoVPN will maybe work for porn but, as they say, "Age verification plays a crucial role across various scenarios, including access to online services, purchases of age-restricted products and claiming age-related benefits."
- alejoar 1y agoYou can’t fence in the wind
- Gazoche 1y agoNo, but once VPNs have become the only escape hatch available, this will be used a justification to ban them.
- lousken 1y agowhat if i were to buy a linux phone? it's not even about desktop support, it's about supporting iOS or android and nothing else which is really bad
- mrtksn 1y agoTangentially, I would love to be able to see the age of everyone on the internet. IRL this gives us so much context when having an interaction.
- HK-NC 1y agoFurther tangent, I'm not big on digital ID and stuff overall but then I'll play an online game with cheaters and wonder if it's not the solution to things like this. Lifetime cross platform online game bans tied to your real life ID which you need to sign into this new all encompassing anticheat.
- mrtksn 1y agoI don't think that anything should be as harsh ever but yes, having a reputation that goes everywhere with you is how we deal with problematic people in real life. That's how we stay civil without AI systems constantly scan us or some type of police constantly watching. Also, we tend to tolerate, forgive and eventually forget when someones behavior improves, so... Maybe actually having a continuous persona can help with the nihilistic tendencies too?
- 0xc0ff338 1y agoFalse positives aren't exactly rare. Cheaters trolled PunkBuster's memory scans by sending offending payloads matching blacklisted signatures over popular IRC channels, less recently they exploited an RCE vulnerability to deploy cheats to other players computers, mid-game. AMD released drivers hooking themselves into games processes, triggering detections. And there's a lot of less obvious problems with this approach.
- meindnoch 1y agoI dream of a world, in which people are judged not by their age but by the content of their character.
- mrtksn 1y agoThere are other interaction modes than judging or hating. Age is useful for many of those, its especially useful for tolerance. Most cultures do have age based moral code for interaction which compensates both for experience(lack of) and decaying cognitive abilities due to age or provides credibility for perspective and trustworthiness. This enforced loss of fidelity is among the primary problems for online communications.
- Devasta 1y agoSo in order to be a part of European society I need to accept the terms and conditions of US companies? What happens if something goes wrong and you have to rely on contacting a human in Google of all places? Sorry, you have a copyright strike on your YouTube account, now you can't file taxes! Hopefully you have enough followers on Twitter than you can get them to pay attention.
- dvdkon 1y agoI finally took a look at the DSA, and it only mentions anything relevant to age verification in three places: - Recital 71, which vaguely suggests minors' privacy and security should be extra-protected, but says that services shouldn't process extra personal data to identify them. - Article 28, which says that platforms should provide a high level of "privacy, safety, and security of minors", again without processing extra personal data to identify them. It also says that the Commision may "issue guidelines", but says nothing suggesting age verification should be implemented. - Article 35, which says that "large online platforms" should maybe implement age verification. Furthermore, recital 57 says that the regulations for online platforms shouldn't apply to micro/small enterprises (which has a definition somewhere). All together, I don't see anything suggesting that anyone but the largest online services is being forced to implement age verification right now. Judging by various posts by the Commision I've seen online, they're certainly pushing for the situation to be seen this way, but de iure, that's currently not happening. EDIT: I found the guidelines mentioned [0], and a nice commentary on the age verification parts [1]. [0]: https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-protection-minors https://digital-strategy.ec.europa.eu/en/library/commission-... [1]: https://dsa-observatory.eu/2025/07/31/do-the-dsa-guidelines-on-protecting-minors-online-strike-the-right-balance/ https://dsa-observatory.eu/2025/07/31/do-the-dsa-guidelines-...
- jeroenhd 1y agoThe digital identity wallet isn't part of the DSA; it is part of an effort to bring identity to your phone, basically: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R1183&qid=1716986198888 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A... If implemented according to plan, things like ID cards, drivers' licenses, diplomas, train tickets, and even payment control can be handled within such apps entirely digitally. Aside from age verification, with attribute based authentication you can prove digitally that you're permitted to drive a certain vehicle without revealing your social security number (equivalent). A healthy dose of cynicism would make clear that the moment such optional infrastructure is rolled out, new legislation can be drafted to "save on expenses" by enforcing this digital model and "protect the kids/fight the terrorists" by forcing age verification on more businesses.
- ktosobcy 1y agoErm... FUT? - this project is just one implementation (POC if you want) - they simply state the current scope of the project For anyone sane managing projects it makes sense to correctly allocate resources that would cover the most people. and to all those whining butthurt individuals here - reality check is that it's way more probable that someone has and uses a smartphone than a computer. go out of your tiny bubbles...
- slackfan 1y agoPapieren Bitte, Citizen.
- afandian 1y agoWhen the UK age verification legislation was being debated I recall people saying "don't worry about unintended consequences, it's not like you'll be have to show your ID to random websites! Someone will show up with a reasonable methodology. You'll be able to e.g. show your ID at a shop and get an anonymous token.". And plenty of people, including myself, thought "this is so dystopian it couldn't possibly happen". It did happen, and it's as bad as the doomsayers said it would be.
- lucb1e 1y agoI would be curious what it's like in the UK. It would probably do well as an HN submission if you're up for writing a blog post about it. All I know is that they passed some legislation that requires people to authenticate for anything that could possibly show nudity or something, including Wikipedia, and that VPN apps were going wild. I don't know what it's actually like in daily life, how one does authenticate to Wikipedia (or if they bought themselves time for now by iirc suing the govt?), if there are privacy-friendly age verification options and if those options are commonly implemented by the websites that need it, etc.
- sjw987 1y agoPersonally I haven't noticed anything with Wikipedia, or Reddit (only ever used when searching for opinions through Google with "Reddit" on the search query). If you want to watch porn or view anything NSFW with websites that complied, I suppose you just start up NordVPN and select Chicago or something like that. Brits who watch porn are probably just watching more American themed porn now. Otherwise, (some of) these websites are supposed to show you a digital verification screen with third party gateways. Usually using an ID card. I'd guess most people just installed VPNs.
- jampekka 1y agoThis is insane. USA is already pushing sanctions against Europeans via US companies (e.g. Microsoft revoking ICC accounts), and now they are about to tie basic functioning in the society to two US megacorporations. At the very least this will solidify the duopoly. At this point I don't find it impossible that critics or other "enemies" of US (or Israel) in Europe will get their phones bricked as sanctions, and as a result become second class citizens. I don't even see the necessity for having hardware attestation. We've had for decades online ID systems that can you can run on any device with an internet connection. But think of the children, right?
- zelphirkalt 1y agoWell, in the end there may only be one thing left we can collectively do, but which we surely won't collectively do, because too many of us are way too comfortable to accept any discomforts: We can avoid using services implementing shit, so that any business that singles out desktop users or disadvantages them, doesn't have much of a customer base. Voting with out feet. I have very little hope, that the common user will make use of their own agency avoiding a dystopia, or even think about issues associated with their behavior. We can see this everywhere even today. The majority of people are clueless and just accept whatever bone is thrown their way. Need to buy a new phone every year now? OK. Pressured to accept digital surveillance by not even state agencies but private profit oriented companies, that want to sell your data or use it for nefarious purposes? OK. Giving all your communication data to big tech? OK. ... It is all just a big "auto-accept any digital rape" for most people, as they don't even want to think about the technical implications and implications for society. It's all so far above their technological understanding, that they just exit the bus, when it comes to discussing these things. That is the problem we face. How to make the normal person aware and interested in their own digital rights.
- Fizzadar 1y agoDepressingly this feels like a long lost battle. I suspect internet freedoms will continue to be eroded and by the time most people care enough it’ll be too late. My optimistic brain is hopeful for federated services to become the norm and stand up to this kind of crap.
- bergfest 1y agoI fear it is already too late, thanks to the phone duopoly and bulletproof secure boot environments. The EU can now make remote attestation mandatory by law.
- bergfest 1y agoWe have to assume this is only the first step. The next step will be mandatory identity attestation for everything and your only choices will be to either accept it or not use any services at all.
- crest 1y agoThese EU politicans should stay the fuck out of things they refuse to understand unless they want to see a real darknet take off.
- snerbles 1y agoAt this point I think they very well do understand. Rocky times are ahead, TPTB know they're at risk if things get bad enough for the average denizen and they want to get in as much leverage against future dissidents as possible.
- EE84M3i 1y agoI think the title "EU age verification app not planning desktop support" is misleading because it gives the impression that there will be no way to support EU age verification on the desktop. This is addressed in the comments: > It should also be noted that this project is an example of a solution that is considered to meet certain requirements of the DSA, regarding the protection of minors. It does not prevent the use of other solutions that also meet those requirements. So I think a better title might be "EU age verification example app not planning desktop support" (don't get me wrong, I'm not a fan of how this is implemented, but it's important to be accurate in our critique)
- bandrami 1y agoI think this ship has sailed; I'm in India and I literally can't spend money without a phone.
- whitehexagon 1y agoAs more people move away from spyPhone devices, how is this going to work. Especially having BigTech being able to hold the EU ransom over access to basic government services. A phone should not be a requirement to partake in society, and I´d even argue the same for a bank account. But I see this month another strong push towards a digital Euro. Is that the true purpose behind this push for .eu ID Apps?
- Almondsetat 1y agoThis is strange, in Italy our eID system can be used from the desktop with a (recent) smart card reader
- rmvt 1y agothis was the case in portugal too, although i don't know if it still is since gov apps have been pushed to the apple and google stores. edit: it should still work according to this https://www.autenticacao.gov.pt/cartao-cidadao/autenticacao https://www.autenticacao.gov.pt/cartao-cidadao/autenticacao
- tiagod 1y agoGov app uses the "Chave Móvel Digital", which can be used in the browser, as well as in a variety of mobile apps. This CMD can also be used to digitally sign documents. I believe it's still possible to use the physical card with a reader for many things. I think some services still don't work with the CMD. Recently, I had to ask for changes to my car's document, and it seems it's only possible with the card itself. (https://www.automovelonline.mj.pt/AutoOnlineProd/ https://www.automovelonline.mj.pt/AutoOnlineProd/)
- lucb1e 1y agoAdd Belgium and Germany to the list. Notably not the Netherlands. They've got the ID card chip (as required internationally iirc) but I emailed them once to get the public key so I can verify signatures (this was like 2016, I was still in school) and they said it was for governmental use only. It's not meant to be used by commercial entities Why the EU decides to go with the bad example rather than the good example, I have no idea. Both ways achieve the stated goal of age verification and even the possible goal of universal ID tracking, without disallowing you to do whatever you want with your phone's privacy settings
- lucabs 1y agoBc it's a smartphone spyware
- codeptualize 1y agoBesides the obvious issues at hand, it's kinda ironic they publish this on Github, EU tech independence is going great.
- jwally 1y agoHere's my crack at a good-enough solution for the U.S. It doesn't have a ton of granularity - but the concept is shovel ready now, dirt cheap, and privacy preserving. Video Demo: https://www.youtube.com/watch?v=MmcUJ5u65Q0 https://www.youtube.com/watch?v=MmcUJ5u65Q0 Actual Demo: https://app.hornpub.click https://app.hornpub.click How it works: 1) Go to app.horpub.click 2) Create an ephemeral passkey 3) Extract its public-key and id (this binds the credential you're creating to your device) 4) The user copies this data to their bank's Age-Verification-Section 5) The bank creates an object that it signs with an attestation of the user's age (KYC) and their pass-key-public-key 6) The user copies this back to app.hornpub.click 7) The passkey is verified on the server, the bank's signature is verified by the server, some other meta-data is verified to make sure nothing weird is happening. 8) The user's age has been verified by their bank without the bank knowing who is asking for verification * This method is more private than anything requiring sharing your photo-id online * This method doesn't trigger GLBA or GDPR (user copies data themselves) * This method is free to the merchant (hornpub)
- SomeoneOnTheWeb 1y agoWhat's crazy to me is why they didn't go for that kind of implementation. This works well, ensures privacy, can be audited easily, and doesn't need a f*cking app on my phone.
- jwally 1y agoIf I work for Aylo (pornhub, etc) I'm telling every fintech and click-and-mortar bank who wants more customers to do this yesterday! "Hey third fifth of Oregon! Do you want to triple your customer base in Oregon for the cost of a small dev team and 1 month of work?!" > f*cking app on my phone I need another app on my phone like I need another hole in my head...
- f_devd 1y agoIf you read the guidelines they actually want to implement a double-blind approach with ZKPs, which imo is significantly better than a challenge-response pub key system in term of privacy. If you're not familiar this would mean the verifier doesn't learns anything except a statement about attributes (age, license, etc); and the EU doesn't learn what attributes have been tried to verify or by who.
- codeptualize 1y agoSeeing this kinda stuff makes me want to keep my physical license and ID. No need for digital ones, I'm good with the cards.
- emigre 1y agoThis post is misleading. The project is just an example. It does not mean there will not be support for other ways of verification.
- Maxious 1y agoArguing with some random developer contracted by European Commission to make example code for mobile devices is not a political solution
- emigre 1y agoExactly
- ulrikrasmussen 1y agoIt also doesn't mean that there will, and it is a strong indication that there won't.
- slackfan 1y agoLooking forward to this becoming the norm in the US at some point around the time I retire from the tech sector to go farm. I will take a nice boat ride into the ocean and throw my phone into a particulary deep spot. I said what I said, do not @ me.
- fvdessen 1y agoIt seems very reasonable to me for a first version of a system to only support the most popular platforms. Especially since this is open source, nothing stops enthusiasts to port the mechanisms to more niche platforms later.
- mzajc 1y ago> Especially since this is open source, nothing stops enthusiasts to port the mechanisms to more niche platforms later. Not even hardware attestation?
- bradley13 1y ago"This makes the web unusable for anyone who wants to browse the web privately." This is not an accident. This is intent. Look at the arrests for social media posts in the UK and Germany.
- bonoboTP 1y agoAnd Hungary https://www.euronews.com/my-europe/2020/05/14/hungary-critics-silenced-in-social-media-arrests-as-eu-debates-orban-s-powers https://www.euronews.com/my-europe/2020/05/14/hungary-critic...
- throw7 1y agoLooks like the 'number of the beast' isn't a number; It's a smartphone from Google or Apple. Who knew?
- f_devd 1y agoI've posted this as a response but I'll post it again since it seems like a lot of people are confused about the project: This project is not THE digital wallet, it is an early prototype of the wallet (which can be criticized for what it is, but the issue is somewhat orthogonal). The actual infrastructure is not based on attenstation, if you read the guidelines (or the readme) they actually want to implement a double-blind approach with ZKPs, which imo is significantly better than a challenge-response pub key system in term of privacy as some suggested. And allows for cross-platform (and in theory hardware) support. If you're not familiar this would mean the verifier doesn't learn anything except a statement about attributes (age, license, etc); and the EU doesn't learn what attributes have been tried to verify or by who.
- NooneAtAll3 1y ago> This project is not THE digital wallet, it is the wallet ...what?
- maxfurman 1y agoGP has edited the comment to make more sense
- deleted 1y ago[deleted]
- vaylian 1y agoThanks for chiming in! Is there some documentation on the Zero-Knowledge-Proof, that this app is supposed to use?
- f_devd 1y agoI don't know the specific ZKP variant if that's what you mean, but the general architecture of the system is best described in the 38C3 talk from earlier this year: https://www.youtube.com/watch?v=PKtklN8mOo0 https://www.youtube.com/watch?v=PKtklN8mOo0 There are some choices that are debatable (more on the issuer side iirc), but imho for the goals it has it's a competently made architecture.
- skybrian 1y agoThey point out that some other service could do it: > It should also be noted that this project is an example of a solution that is considered to meet certain requirements of the DSA, regarding the protection of minors. It does not prevent the use of other solutions that also meet those requirements. Is anyone building that service?
- lucb1e 1y agoThe EU is paying for this one but not other ones apparently. Strange. It's almost as though they're paying to build what they plan to use rather than making an example for the heck of it
- harrisoned 1y ago> At present the project is focused on mobile platforms, specifically Android and iOS, as they cover the vast majority of users and real-world use cases. (..) Desktop support is not currently within the project's scope. This is the equivalent of a "Do you guys not have phones??"[1] but on a way larger scale. At least where i live i am able to use the bare minimum of phones, even working with tech. The friction is increasing though, which worries me a lot, and day after day there is a new attempt to shove it down your throat if you want to be considered a member of society. Seeing that a lot of countries (including mine) are pushing for age verification, and the whole thing about Android blocking 'sideload', by the end of 2026 you won't be considered a human being without a government certified smartphone. [1]: https://www.youtube.com/watch?v=ly10r6m_-n8 https://www.youtube.com/watch?v=ly10r6m_-n8
- kulahan 1y agoI do find it interesting that in an attempt to bring more people into modern society (via ability to access everything from an inexpensive smartphone), we're creating a stratification in society. My brother hates tech more than me, and only has an old flip phone. I'm always surprised by the random problems he runs into as a result. Unresponsive desktop sites that beg you to download apps are the worst.
- FridayoLeary 1y agoHow is it that in todays day and age websites can be broken on desktops and favours smartphones? They are at best a compromised ux. Small screens and they are awkward to type on. Those are inherent limitations which are unlikely to change anytime soon. folding phones are a niche item and are likely to stay that way for the forseeable future. Tactile touchscreens will only mitigate the inherent drawbacks not solve them. The other solution is of course wearables like ar but not surprisingly people are stubbornly resisting buying them. I'm not sure what Apple and Meta were even thinking. What else is there? Projected holograms in 3d like in movies? I'm not yet ready for my entire world to turn blue.
- ACCount37 1y ago"Mandatory app" is an anti-accessibility anti-feature.
- gclawes 1y agoTin foil hat time: this is why Google is pushing to kill app sideloading. Mobile phones are the only platform at the moment that can reasonably be used to enforce mandatory software installs and remote attestation. Removing sideloading can down the road leading to Google (or Apple for IOS) forcing all app store provided apps/browsers to support government authentication APIs like this.
- irusensei 1y agoGoogle is gung-ho on embracing every kind of identification law because it aligns with their business model. They sell ads therefore it is important that humans are authenticated. Other social media companies like X have similar incentives.
- machiaweliczny 1y agoIt's general hard to have discourse online without some good authentication as bots dominate everything. That's why normal people use mostly facebook groups. This needs some solution but gov ID isn't it, unless it's some cryptographic thing that is passed to other services that link data with their own salt or something like that. Having said that I like how in PL we have very nice auth to all government services that finally works well (it's like 5th implementation of this system). It makes it very easy to use gov services and before had to login with bank accounts or create some crappy accounts. Now it just works with faceID and done. You can also login to 3rd parties as well. For example I was able to get my medical health results info from commercial provider by sharing basic info from this auth app without creating account or anything (they get access to Gov ID).
- machiaweliczny 1y agoIf there was something like that guarantees pseudonymous ID that can't be reversed via rainbow tables like stuff that could be useful as general login ID. I would like to have ability to choose if I use new one for this provider or one that can be linked with other services. Kinda like with apple anonymising emails. Are there any efforts in this directions?
- jeffrallen 1y agoI looked into the Swiss version of this, which is documented here: https://swiyu-admin-ch.github.io/ https://swiyu-admin-ch.github.io/ They faced the same question. Here is their answer: https://github.com/orgs/swiyu-admin-ch/discussions/20 https://github.com/orgs/swiyu-admin-ch/discussions/20 The tldr is that they have a legal requirement to bind "verifiable credential shares" with the same human who got the e-ID originally, up to the current best practical technology. On Android, they judge that to be "keep the private key in the HSM and require a local biometric (or PIN) unlock to use it". This is why they argue that proving your age will not be possible without a mobile device. You can prove your age anonymously, for anonymous account, which can be used on a non-mobile device. It's just that the proving the age part must happen from a mobile device. À propos of more or less nothing: in the Swiss context, websites requesting the proof will be required to request the least information necessary for their need. They must NOT ask for your name, ID number, or birthdate if the question they are trying to answer is, "is this person old enough for our service?" This is excellent technology, and the Swiss law on it that we are voting for next weekend is an excellent law, so I urge a OUI/JA/SI vote on it, if you're a Swiss citizen.
- fh973 1y agoDonald, is it you?
- lucb1e 1y ago> The tldr is that they have a legal requirement to bind "verifiable credential shares" with the same human who got the e-ID Glancing at the thread, I don't see that conclusion. User 'sideeffect42' cites some laws and says >> As I read this it nowhere says that the e-ID has to be bound to a device. It only speaks about binding it to its owner which (IANAL) could be implemented by password protection (like KeePass) as well, since only the owner knows the password. Nobody seems to have replied to that Alternatively, the software could just scan your ID card's chip when you need it, or whatever it is that it does for first-time-use verification anyway. It needs not require your phone is locked down, locking you out of any control over tracking, installed apps, or reading the phone's storage and network traffic to merely see what it tracks about you. The phone can simply act as an NFC reader so that your ID can sign a challenge with an "over 18" flag included within the signed data And that's if you want ubiquitous age verification in the first place. I find that u/raincole made a good point here that outlandish implementations have successfully shifted the discussion away from the aspect of whether ID-based checks must be widely performed: https://news.ycombinator.com/item?id=45361883 https://news.ycombinator.com/item?id=45361883 > so I urge [to vote a certain way], if you're a Swiss citizen Is this post genuinely trying to add something to the thread, or a way to promote your agenda?
- renewiltord 1y agoEU gonna EU. You should be thankful. If they made a desktop app answering the cookie banner would rival applying for citizenship in complexity.
- oblio 1y agoYou do know that all those sudden repairability and longer OS updates Samsung and Apple keep touting worldwide are due to EU regulations, right? Easy battery and screen replacements, USB C on iPhones, 7 years of US updates, etc, all due to the EU.
- renewiltord 1y agoYeah, all sorts of pointless crap. 7 years of updates, that's the iPhone X? Yeah I couldn't care less. USB-C? Don't care. I use wireless charging. If we could lose all of that in exchange for losing cookie banners I would take it in a heartbeat. In another couple of decades the EU will be an irrelevant market as their population becomes even poorer. Then we can finally be free of their nonsense. The only risk is that the Eastern European countries become more prosperous than the Western European ones and prop up their influence.
- oblio 1y agoSure, then you can enjoy the wonders of 9/9/6 and coal rolling as you wish. Oh, wait, you can already do that :-)
- graemep 1y agoOnly available on Android and ios, only installable from Google and Apple App stores (in practice now, but completely when Google tightens control). So much for digital sovereignty.
- rnaarten 1y agoIt's more then reliance on smartphones, it is reliance on people having a Google or apple account to actually download the app. That's a large factor worse. The digital identity wallet has as one of its spear points privacy, but it forces you to have that big tech privacy slaying account. It's a privacy tying sale.
- Geee 1y agoThe much bigger issue is that it's the first time when you're required by law to install government software on your devices. It's breaching your private space and it's immoral and wrong. Private spaces, including digital, should be protected from government by constitutional law.
- lucb1e 1y ago> the first time you're required by law to install government software on your devices If it were only that. We could sandbox it, deny it permissions it doesn't need, or inspect what it does. All fine and dandy. No, it's the first time a democratic government requires you to carry a 5G video recorder that you can't turn off short of smashing it to pieces if the manufacturer is ordered to make it so. But then you can't do half the things a normal person can do so you won't smash it to pieces if you don't have evidence it's currently acting as a bug. The EU software tries to detect when you put it in a sandbox or when you merely try to inspect what it's doing. Attach a debugger and it'll refuse to verify your age to social media so you can't use that anymore. Install an open source OS on your phone and you can't so much as legally obtain your own government's software in the first place.
- emigre 1y agoI think that the European Digital Identity project should not be hosting its source code and content related to European standards, guidelines, and initiatives on GitHub, a closed source product owned by Microsoft.
- pennaMan 1y agoWhy stop there? Go all in: they should not run their open source totalitarian digital control nightmare codebase on closed source hardware, because that's the real issue!
- emigre 1y agoIf Dr. Evil created a death ray machine to destroy all life on Earth, I would be there to say “oh it is based on an open standard, how nice”.
- emigre 1y agoIf nonprofits like the FSF or communities like the Debian project are able to store their code, why is an organisation with the magnitude of the European Comission unable to do it.
- irusensei 1y agoQuick! Save the EU from Microsoft by cloning it to your hard drive so the code can be safe and sound. Nah seriously this doesn't really apply to Git.
- emigre 1y ago[dead]
- rwyinuse 1y agoI wonder how this aligns with EU's accessibility act. Covering "the vast majority of users and real-world use cases" isn't really enough based on EU's own regulation.
- kkfx 1y agoWhat a sovereign tech indeed, considered that both Android and iOS are USA flagship mobile OSes... Beside that, as long as people do not realize that Desktops are for personal ownership and personal production while mobile are only for surveillance and consumption all digitization efforts will push those who knows toward something else, cryptos instead of legal tender money, self-hosted stuff and so on. As a result at a given point in time population will be split in two main cohort: those who knows vs all the rest.
- qwerty456127 1y agoEU is just rushing into bullshit dystopia scifi with its useless and harmful anonymization and chat control ideas. These just ought to fail and be rolled back. Imagining these succeed seems nearly as wild as waking up in the world where people do yakuza-style thumb cut to every naughty kid who fails to do his homework.
- emigre 1y agoDenmark has a digital ID service for its citizens called MitID which includes a 2FA system that can involve a smartphone app, but not necessarily. Citizens can request a code display device if they prefer not to use an app. There are also audio code readers for people with impaired vision. The system works really well and it’s very convenient.
- stronglikedan 1y agosurface tablet sales soar!
- jacquesm 1y agoI guess I'll pass then.
- tempesttea 1y agoSmart move, no sense making an app to tell you all us desktop users are old.
- wartywhoa23 1y agoIn these huge whirls of dust stirred by violent Overton Window movements, I'm struggling to find any single voice raising concerns not about the lack of available instuments of oppression on desktop machines, but rather about the fact of coersion to embrace said instruments itself
- Fire-Dragon-DoL 1y agoSo we have an open and free platform,the web, and the EU is choosing to do this behind two american companies (apple and google). So smart! (Sarcasm)
- ggm 1y agoIs this an implementation of homomorphic encrypted proofs through a third party?
- tmtvl 1y agoIf a service is only available through an app from either the Google Play Store or the Apple App Store then use of that service is dependent on acceptance of either Alphabet's Terms Of Service, or worse, Apple's TOS. Considering these two organisations play fast and loose with universal human rights and have been fined multiple times for consumer-hostile behaviour... well, I'd say that consumer protection organisations should really do something about this.
- sejin8642 1y agoI am not sure if it is feasible, but is there a way to have age-verification only once method on your phone? If you're a sole owner of your phone that no one else uses, can you have your phone age-verified? So you don't have to deal with age verification process every single time you try to access age-restricted information.
- doctorshady 1y agoAt this point, does not carrying a smartphone become a form of protest?
- bni 1y agoEU: You must use a device owned and controlled by US companies to prove your standing in the EU.
- dns_snek 1y agoNot surprised after the Play Integrity/hardware attestation debacle [1]. The arrogance and incompetence of people involved in this project is indistinguishable from malice. [1] https://github.com/eu-digital-identity-wallet/av-doc-technical-specification/discussions/19#discussioncomment-13944051 https://github.com/eu-digital-identity-wallet/av-doc-technic...
- mvdtnz 1y ago[flagged]
- kldg 1y agojust a few thoughts: 1) so long as these age verification methods are for things at home, I think most people opposed to smartphones ("client devices" we have to pay for) will not be too inconvenienced. a few years ago, broker quit letting us use plastic code cards for 2FA and required we used an Android/iOS device, but I'm willing to tolerate having a single-purpose tablet in a drawer, though I'm still annoyed to essentially have a $100 undisclosed fee attached to service I have to pay every 3-4 years when they drop support for older versions of Android. 2) I've so far only been locked out of minor services like Anthropic by not having smartphone w/ mobile service, not because they require app use but because they ban VOIP numbers for registration. many businesses do charge me a little extra for not using a smartphone, but the cost is not too high, about on par with ignoring loyalty cards. 3) this cannot ever be required for something like onsite ID verification (e.g. at an airport) or I would be locked out of essential government processes. I'm willing to keep a device in a drawer, but will never carry a client device around with me. 4) this is not a problem exclusively for elderly grandma with satellite brick phones. I'm in my 30s with IT/developer background.
- shortsunblack 1y agoThe current reference design is not compatible with existing law. eIDAS regulation that is the legal basis for digital wallet mandates unlinkability. GDPR has a general requirement for technical controls to be state of the art. Inherent reliance on American monopolies is incompatible with Digital Markets Act. The current design and usage of cryptographic primitives does not allow for unlikability (it is actually quite easy to for verifiers and relying parties to collude) and it certainly is not state-of-the-art. BBS signatures would achieve actual unlinkability, but those have been outright rejected by the designers. Current implementation is poised to not comply with the regulation that established the mandate for the wallet and it violates GDPR. The best one could hope for is for CJEU to strike down the whole project. The GitHub organization of the OP's post has various issues that discuss these ills. Here is a position of several cryptographers against the current design: https://github.com/eu-digital-identity-wallet/eudi-doc-architecture-and-reference-framework/issues/200 https://github.com/eu-digital-identity-wallet/eudi-doc-archi...
- selinkocalar 1y agoOk but what if you don’t have a smartphone ?
- 3abiton 1y agoTalk about EU and accessibility.