4 ms·

EU Age Verification Solution

28 points by t0bia_s 6mo ago

nilslindemann 6mo ago
What about users with no smart phone?
- techcode 6mo ago
  In The Netherlands I wouldn't be able to login to any government or adjecent websites (e.g. portal of my local health center/GP, health insurance, retirement/pension insurance) without a smart phone running DigiD app for 2FA. The non-EU Serbia has the equivalent app, but also you might be able to get individual/personal e-certificate (for logging into e-government or signing e-documents) added into smart card chip of your ID. But in practice it seems thats only used for business purposes, like CEO/Accountants/etc to sign/submit business records/taxes.
  - tmtvl 6mo ago
    In Belgium the eID software runs on GNU/Linux, so I can log in to government websites using my ID card and a card reader. In my experience it even works better on GNU/Linux than on MS Windows. It's one of the only things that Belgium does right.
  - closuregarden 6mo ago
    The DigiD app isn't required. You can log-in with DigiD using SMS 2FA. This is what I currently do, because I don't want to install closed-source software on my device.
  - mcv 6mo ago
    DigiD used to work fine without an app. I think it still does, because I have to explicitly select using the app to log in.
  - exceptione 6mo ago
    Dumb phone works as well with sms verification.
    - techcode 6mo ago
      I used to work for a GSM messaging gateway/SMSC. And seeing first hand how most of those SMS messages (2FA, password reset, bank transaction/balance ...etc) are usually routed (sure over SSL but stored/forwarded as unencrypted GSM packets) through several different companies around the world - before reaching your mobile operator ... And on top of that you add stuff like sim cloning, and all the other things that one gets by having a direct SS7 connection (there were blog posts/YouTube videos - IIRC Linus Tech Tips calls/SMS got routed to Australia). Using SMS for 2FA or anything similar is my last resort. Granted I stopped working there 15+ years ago - but I imagine that the basic economy reasoning where it's impractical for every mobile operator to have a direct peering contract with every other operator in the world - is still the same. And messages originating from non mobile users/operators (like DigiD 2FA) always start at one of these messaging gateways/SMSCs (e.g. InfoBip.com), and often go through a few different ones before reaching your mobile operator.
- pjmlp 6mo ago
  No smartphnone and dependent on two US companies, is there an official complaint form? EDIT: A possible way, https://european-union.europa.eu/contact-eu/write-us_en https://european-union.europa.eu/contact-eu/write-us_en
- Someone 6mo ago
  From skimming the texts, I don’t see a 100% hard requirement of using a smart phone. Yes, in https://ageverification.dev/av-doc-technical-specification/docs/architecture-and-technical-specifications/ https://ageverification.dev/av-doc-technical-specification/d..., section 2.3 User Journey says “To enable online age verification, the User is required to install an AV app on their mobile device” but section 3 Architecture says “The solution relies on a device-based proof of age model, leveraging widely available mobile devices such as smartphones and tablets to store age attestations. This approach supports the goal of rapid deployment and broad accessibility. Alternative mechanisms for storing and presenting proof of age may be considered for future versions of the solution.” and “It is also recognised that devices may be shared among multiple users, for example, when a child has access to a parent’s mobile phone” That indicates the child may not need to have a smartphone. I think the vast majority of cases where this will be used it with users wanting to run smartphone or tablet apps, though. For those cases, requiring the user to own a smartphone isn’t problematic.
  - jampekka 6mo ago
    The app is available only on Android (and maybe iOS) and requires Google/Apple attestation. There's been extensive discussion about this, but the developers refuse to even fully acknowledge the problem.
    - Someone 6mo ago
      Is there a “the App”? The text I referenced talks of “a Reference Implementation”. That suggests, to me, that there will be multiple apps, leaving open ones for other platforms than smartphones. And yes, it remains to be seen whether, as they say “alternative mechanisms for storing and presenting proof of age” that “may be considered for future versions of the solution” actually will actually surface, but their argument “The solution relies on a device-based proof of age model, leveraging widely available mobile devices such as smartphones and tablets to store age attestations. This approach supports the goal of rapid deployment and broad accessibility.” has merit.
      - 6mo ago
DavideNL 6mo ago
Original url / Statement by von der Leyen: https://news.ycombinator.com/item?id=47778263 https://news.ycombinator.com/item?id=47778263
jampekka 6mo ago
The slogan "Age Verification Solution for all Europeans" is a lie. The honest slogan is "Age Verification Solution for Europeans Who Use Mobile Devices that are Controlled by US Corporations and by Extension US Government Which Can Revoke Your Use of the Solution with No Recourse".
- econ 6mo ago
  I asked about the wero[1] US tech lock-in since it is based on Ideal which (in contrast) also works with a browser + card reader + pin code. The response was not to worry about that. Wtf? I also find the de-banking mechanism fascinating. Bunch of anons decide privately if you are fkd for whatever reason they want (if any) [1] - https://wero-wallet.eu https://wero-wallet.eu
tiel88 6mo ago
I couldn't possibly even begin to express the vastness of my disdain for these Eurocrats... but even I can't believe they decided to name it EAVS. The EAVS will be dropping yeah?
budududuroiu 6mo ago
EU leaders are aware that for the next couple of decades, they will have to lead from a position of deep unpopularity. This is the "solution" to that problem, not whatever they're claiming is the problem.
- raxxorraxor 6mo ago
  I really doubt it will establish itself as something broadly adopted. Perhaps the EU tries to force the issue, but that will undermine this "solution" as well and there are ways to evade that. There were good ideas at first but especially data protection features have already been scrapped. Also you need to buy into the Apple or Google ecosystem, no alternatives allowed. Especially funny if the next sentence contains some reference about independence... I will not use it for anything privately as I neither trust the issuer, nor the notified bodies providing the infrastructure. Our police accessed app data from Corona movement apps, it will do the same for any and all digital solutions the bureaucracy tries to sell. This is political problem we had for decades. Authorities aren't trustworthy, the legislative refuses to introduce strong privacy protection and instead tries to do the opposite. They even further enabled large platforms to scrap user data even more unhinged. To hell with them and with their shitty projects, I don't need a shitty content gatekeeper, even if you pay me.
- squigz 6mo ago
  > they will have to lead from a position of deep unpopularity Can you elaborate on... why?
  - t0bia_s 6mo ago
    Tons of regulations over and over. General Data Protection Regulation (GDPR) EU Artificial Intelligence Act (AI Act) ePrivacy Directive (Cookie Law) Digital Services Act (DSA) Digital Markets Act (DMA) Common Agricultural Policy (CAP) Carbon Border Adjustment Mechanism (CBAM) EU Emissions Trading System (ETS) Corporate Sustainability Due Diligence Directive (CSDDD) REACH Regulation (chemicals control) Packaging and Packaging Waste Regulation (PPWR) Nature Restoration Law Renewable Energy Directive (RED III) Working Time Directive Posted Workers Directive Roaming Regulation (price caps for telecoms) VAT Directive (harmonized VAT rules) State Aid Rules Schengen Border Code (migration/border controls) Eco-design and product standardization rules Corporate Sustainability Reporting Directive (CSRD) EU Taxonomy Regulation Sustainable Finance Disclosure Regulation Regulation to Prevent and Combat Child Sexual Abuse It dictate sustainability, but instead create unsustainable behemot that costs tax payers more than it brings. It hampers competitiveness, remove freedoms from citizens and holding back the economy. One of the original ideas of building EU was to bring common market. Not any more. Basically EU holds power through funding projects by grants, which fundamentally breaks free market and there is no transparency in it (ie. Pfizer contracts, proponents of Chat Control, etc.).
xinayder 6mo ago
The best solution is to not have age verification. Period.

28 points by t0bia_s 6mo ago

nilslindemann 6mo ago

What about users with no smart phone?

techcode 6mo ago
In The Netherlands I wouldn't be able to login to any government or adjecent websites (e.g. portal of my local health center/GP, health insurance, retirement/pension insurance) without a smart phone running DigiD app for 2FA. The non-EU Serbia has the equivalent app, but also you might be able to get individual/personal e-certificate (for logging into e-government or signing e-documents) added into smart card chip of your ID. But in practice it seems thats only used for business purposes, like CEO/Accountants/etc to sign/submit business records/taxes.
- tmtvl 6mo ago
  In Belgium the eID software runs on GNU/Linux, so I can log in to government websites using my ID card and a card reader. In my experience it even works better on GNU/Linux than on MS Windows. It's one of the only things that Belgium does right.
- closuregarden 6mo ago
  The DigiD app isn't required. You can log-in with DigiD using SMS 2FA. This is what I currently do, because I don't want to install closed-source software on my device.
- mcv 6mo ago
  DigiD used to work fine without an app. I think it still does, because I have to explicitly select using the app to log in.
- exceptione 6mo ago
  Dumb phone works as well with sms verification.
  - techcode 6mo ago
    I used to work for a GSM messaging gateway/SMSC. And seeing first hand how most of those SMS messages (2FA, password reset, bank transaction/balance ...etc) are usually routed (sure over SSL but stored/forwarded as unencrypted GSM packets) through several different companies around the world - before reaching your mobile operator ... And on top of that you add stuff like sim cloning, and all the other things that one gets by having a direct SS7 connection (there were blog posts/YouTube videos - IIRC Linus Tech Tips calls/SMS got routed to Australia). Using SMS for 2FA or anything similar is my last resort. Granted I stopped working there 15+ years ago - but I imagine that the basic economy reasoning where it's impractical for every mobile operator to have a direct peering contract with every other operator in the world - is still the same. And messages originating from non mobile users/operators (like DigiD 2FA) always start at one of these messaging gateways/SMSCs (e.g. InfoBip.com), and often go through a few different ones before reaching your mobile operator.
pjmlp 6mo ago
No smartphnone and dependent on two US companies, is there an official complaint form? EDIT: A possible way, https://european-union.europa.eu/contact-eu/write-us_en https://european-union.europa.eu/contact-eu/write-us_en
Someone 6mo ago
From skimming the texts, I don’t see a 100% hard requirement of using a smart phone. Yes, in https://ageverification.dev/av-doc-technical-specification/docs/architecture-and-technical-specifications/ https://ageverification.dev/av-doc-technical-specification/d..., section 2.3 User Journey says “To enable online age verification, the User is required to install an AV app on their mobile device” but section 3 Architecture says “The solution relies on a device-based proof of age model, leveraging widely available mobile devices such as smartphones and tablets to store age attestations. This approach supports the goal of rapid deployment and broad accessibility. Alternative mechanisms for storing and presenting proof of age may be considered for future versions of the solution.” and “It is also recognised that devices may be shared among multiple users, for example, when a child has access to a parent’s mobile phone” That indicates the child may not need to have a smartphone. I think the vast majority of cases where this will be used it with users wanting to run smartphone or tablet apps, though. For those cases, requiring the user to own a smartphone isn’t problematic.
- jampekka 6mo ago
  The app is available only on Android (and maybe iOS) and requires Google/Apple attestation. There's been extensive discussion about this, but the developers refuse to even fully acknowledge the problem.
  - Someone 6mo ago
    Is there a “the App”? The text I referenced talks of “a Reference Implementation”. That suggests, to me, that there will be multiple apps, leaving open ones for other platforms than smartphones. And yes, it remains to be seen whether, as they say “alternative mechanisms for storing and presenting proof of age” that “may be considered for future versions of the solution” actually will actually surface, but their argument “The solution relies on a device-based proof of age model, leveraging widely available mobile devices such as smartphones and tablets to store age attestations. This approach supports the goal of rapid deployment and broad accessibility.” has merit.
    - 6mo ago

DavideNL 6mo ago

Original url / Statement by von der Leyen: https://news.ycombinator.com/item?id=47778263 https://news.ycombinator.com/item?id=47778263

jampekka 6mo ago

The slogan "Age Verification Solution for all Europeans" is a lie. The honest slogan is "Age Verification Solution for Europeans Who Use Mobile Devices that are Controlled by US Corporations and by Extension US Government Which Can Revoke Your Use of the Solution with No Recourse".

econ 6mo ago
I asked about the wero[1] US tech lock-in since it is based on Ideal which (in contrast) also works with a browser + card reader + pin code. The response was not to worry about that. Wtf? I also find the de-banking mechanism fascinating. Bunch of anons decide privately if you are fkd for whatever reason they want (if any) [1] - https://wero-wallet.eu https://wero-wallet.eu

tiel88 6mo ago

I couldn't possibly even begin to express the vastness of my disdain for these Eurocrats... but even I can't believe they decided to name it EAVS. The EAVS will be dropping yeah?

budududuroiu 6mo ago

EU leaders are aware that for the next couple of decades, they will have to lead from a position of deep unpopularity. This is the "solution" to that problem, not whatever they're claiming is the problem.

raxxorraxor 6mo ago
I really doubt it will establish itself as something broadly adopted. Perhaps the EU tries to force the issue, but that will undermine this "solution" as well and there are ways to evade that. There were good ideas at first but especially data protection features have already been scrapped. Also you need to buy into the Apple or Google ecosystem, no alternatives allowed. Especially funny if the next sentence contains some reference about independence... I will not use it for anything privately as I neither trust the issuer, nor the notified bodies providing the infrastructure. Our police accessed app data from Corona movement apps, it will do the same for any and all digital solutions the bureaucracy tries to sell. This is political problem we had for decades. Authorities aren't trustworthy, the legislative refuses to introduce strong privacy protection and instead tries to do the opposite. They even further enabled large platforms to scrap user data even more unhinged. To hell with them and with their shitty projects, I don't need a shitty content gatekeeper, even if you pay me.
squigz 6mo ago
> they will have to lead from a position of deep unpopularity Can you elaborate on... why?
- t0bia_s 6mo ago
  Tons of regulations over and over. General Data Protection Regulation (GDPR) EU Artificial Intelligence Act (AI Act) ePrivacy Directive (Cookie Law) Digital Services Act (DSA) Digital Markets Act (DMA) Common Agricultural Policy (CAP) Carbon Border Adjustment Mechanism (CBAM) EU Emissions Trading System (ETS) Corporate Sustainability Due Diligence Directive (CSDDD) REACH Regulation (chemicals control) Packaging and Packaging Waste Regulation (PPWR) Nature Restoration Law Renewable Energy Directive (RED III) Working Time Directive Posted Workers Directive Roaming Regulation (price caps for telecoms) VAT Directive (harmonized VAT rules) State Aid Rules Schengen Border Code (migration/border controls) Eco-design and product standardization rules Corporate Sustainability Reporting Directive (CSRD) EU Taxonomy Regulation Sustainable Finance Disclosure Regulation Regulation to Prevent and Combat Child Sexual Abuse It dictate sustainability, but instead create unsustainable behemot that costs tax payers more than it brings. It hampers competitiveness, remove freedoms from citizens and holding back the economy. One of the original ideas of building EU was to bring common market. Not any more. Basically EU holds power through funding projects by grants, which fundamentally breaks free market and there is no transparency in it (ie. Pfizer contracts, proponents of Chat Control, etc.).

xinayder 6mo ago

The best solution is to not have age verification. Period.