3 ms·

I looked into the Swiss version of this, which is documented here: https://swiyu-admin-ch.github.io/ https://swiyu-admin-ch.github.io/ They faced the same ques

I looked into the Swiss version of this, which is documented here: https://swiyu-admin-ch.github.io/ https://swiyu-admin-ch.github.io/ They faced the same question. Here is their answer: https://github.com/orgs/swiyu-admin-ch/discussions/20 https://github.com/orgs/swiyu-admin-ch/discussions/20 The tldr is that they have a legal requirement to bind "verifiable credential shares" with the same human who got the e-ID originally, up to the current best practical technology. On Android, they judge that to be "keep the private key in the HSM and require a local biometric (or PIN) unlock to use it". This is why they argue that proving your age will not be possible without a mobile device. You can prove your age anonymously, for anonymous account, which can be used on a non-mobile device. It's just that the proving the age part must happen from a mobile device. À propos of more or less nothing: in the Swiss context, websites requesting the proof will be required to request the least information necessary for their need. They must NOT ask for your name, ID number, or birthdate if the question they are trying to answer is, "is this person old enough for our service?" This is excellent technology, and the Swiss law on it that we are voting for next weekend is an excellent law, so I urge a OUI/JA/SI vote on it, if you're a Swiss citizen.

fh973 1y ago
Donald, is it you?
lucb1e 1y ago
> The tldr is that they have a legal requirement to bind "verifiable credential shares" with the same human who got the e-ID Glancing at the thread, I don't see that conclusion. User 'sideeffect42' cites some laws and says >> As I read this it nowhere says that the e-ID has to be bound to a device. It only speaks about binding it to its owner which (IANAL) could be implemented by password protection (like KeePass) as well, since only the owner knows the password. Nobody seems to have replied to that Alternatively, the software could just scan your ID card's chip when you need it, or whatever it is that it does for first-time-use verification anyway. It needs not require your phone is locked down, locking you out of any control over tracking, installed apps, or reading the phone's storage and network traffic to merely see what it tracks about you. The phone can simply act as an NFC reader so that your ID can sign a challenge with an "over 18" flag included within the signed data And that's if you want ubiquitous age verification in the first place. I find that u/raincole made a good point here that outlandish implementations have successfully shifted the discussion away from the aspect of whether ID-based checks must be widely performed: https://news.ycombinator.com/item?id=45361883 https://news.ycombinator.com/item?id=45361883 > so I urge [to vote a certain way], if you're a Swiss citizen Is this post genuinely trying to add something to the thread, or a way to promote your agenda?
- jeffrallen 1y ago
  This post made you and a bunch of other people aware of where to go engage with the Swiss e-ID devs if you want, so hopefully you found that useful.

fh973 1y ago

Donald, is it you?

lucb1e 1y ago

> The tldr is that they have a legal requirement to bind "verifiable credential shares" with the same human who got the e-ID Glancing at the thread, I don't see that conclusion. User 'sideeffect42' cites some laws and says >> As I read this it nowhere says that the e-ID has to be bound to a device. It only speaks about binding it to its owner which (IANAL) could be implemented by password protection (like KeePass) as well, since only the owner knows the password. Nobody seems to have replied to that Alternatively, the software could just scan your ID card's chip when you need it, or whatever it is that it does for first-time-use verification anyway. It needs not require your phone is locked down, locking you out of any control over tracking, installed apps, or reading the phone's storage and network traffic to merely see what it tracks about you. The phone can simply act as an NFC reader so that your ID can sign a challenge with an "over 18" flag included within the signed data And that's if you want ubiquitous age verification in the first place. I find that u/raincole made a good point here that outlandish implementations have successfully shifted the discussion away from the aspect of whether ID-based checks must be widely performed: https://news.ycombinator.com/item?id=45361883 https://news.ycombinator.com/item?id=45361883 > so I urge [to vote a certain way], if you're a Swiss citizen Is this post genuinely trying to add something to the thread, or a way to promote your agenda?

jeffrallen 1y ago
This post made you and a bunch of other people aware of where to go engage with the Swiss e-ID devs if you want, so hopefully you found that useful.