3 ms·

The "app" could be a good solution, if it didn't require attested Android or iOS. It could, for example, have me plug my ID chip into my GNU/Linux system and ex

The "app" could be a good solution, if it didn't require attested Android or iOS. It could, for example, have me plug my ID chip into my GNU/Linux system and expose it with a standard protocol. That would be no problem. The problem is that they do not want such a way. In any case, I think that age gating would not be needed if the platforms were regulated to remove addictive recommendation algorithms.

yorwba 3mo ago
Using an ID card reader is already possible. See here for a list of Linux repos supporting German IDs: https://www.ausweisapp.bund.de/en/open-source https://www.ausweisapp.bund.de/en/open-source Finding a working hardware/software combination for your ID card is up to you. The app is an alternative for people who don't want to buy or carry around a card reader, but who already have a smartphone.
- roundabout-host 3mo ago
  It is possible for e-signatures and similar variants. However, there is no sign that the "age verification" will support this variant. If you go to the demo <https://cinema.ageverification.dev https://cinema.ageverification.dev>, no option is given other than the Android/iOS app. So it seems that the app is only an alternative in the case of government portals, but it is not an alternative for "age verification".
  - lern_too_spel 3mo ago
    The German implementation already allows it. The GitHub issue you linked to explains multiple times that it is a reference implementation, as have several previous HN comment threads linking to this page. It is not the actual implementation that any country plans to use.
    - roundabout-host 3mo ago
      The German implementation allows it for some uses, but not for "age verification". The demo does not account for the fact that other options may exist.
alistairSH 3mo ago
ID chip? Is that something everybody in the EU (or whatever region) has? Is it just embedded in your driver license or passport? [I'm in the US, we're very ID-averse here, weird, but is what it is]
- arrrg 3mo ago
  ID cards aren’t exactly super standardized inside the EU. German ID cards have a RFID chip which basically contains all the same info that’s printed on the outside (PIN protected). Smartphones can read that chip and the state as well as private businesses could in principle use this to do age verification – even the super minimal version of age verification that just asks for a certain age threshold and gets a binary response whether that threshold is met. (Which to me if we can achieve it is the perfect solution.) The infrastructure is there and since 2017 those RFID chips are even actived by default when new ID cards are issued. (The cards are valid for ten years so nearly all ID cards have those active chips.) The biggest issue currently is a network effect one: hardly anyone is using the chip so people don’t create their initial PIN, creating a UX hurdle for adoption. (If you want to use your ID card chip you have to find your initial PIN somewhere in your documents – if you didn’t throw it away – and then create your proper PIN, you can’t just start using it.) I can sense usage increasing but exactly because of the poor initial use UX all sorts of private alternate solutions exist that are plain worse from a privacy preserving point of view. For example ones where you film your ID card from both sides (so the hologram is visible) which just suck. (You just share everything … which is just so unnecessary.) To change this we would need a policy that requires age verification without sharing the birthdate or any other PII.
  - alistairSH 3mo ago
    Yeah, that sounds like the ideal solution. Unfortunately, we can't even get states to commit to our RealID requirements[1] (which doesn't even add a chip/PIN, it only strengthens validation of documents submitted at the time of application for a driving license). And the notion of a national ID is anathema to large swaths of the population. 1 - https://en.wikipedia.org/wiki/REAL_ID_Act https://en.wikipedia.org/wiki/REAL_ID_Act
- 3mo ago

yorwba 3mo ago

Using an ID card reader is already possible. See here for a list of Linux repos supporting German IDs: https://www.ausweisapp.bund.de/en/open-source https://www.ausweisapp.bund.de/en/open-source Finding a working hardware/software combination for your ID card is up to you. The app is an alternative for people who don't want to buy or carry around a card reader, but who already have a smartphone.

roundabout-host 3mo ago
It is possible for e-signatures and similar variants. However, there is no sign that the "age verification" will support this variant. If you go to the demo <https://cinema.ageverification.dev https://cinema.ageverification.dev>, no option is given other than the Android/iOS app. So it seems that the app is only an alternative in the case of government portals, but it is not an alternative for "age verification".
- lern_too_spel 3mo ago
  The German implementation already allows it. The GitHub issue you linked to explains multiple times that it is a reference implementation, as have several previous HN comment threads linking to this page. It is not the actual implementation that any country plans to use.
  - roundabout-host 3mo ago
    The German implementation allows it for some uses, but not for "age verification". The demo does not account for the fact that other options may exist.

alistairSH 3mo ago

ID chip? Is that something everybody in the EU (or whatever region) has? Is it just embedded in your driver license or passport? [I'm in the US, we're very ID-averse here, weird, but is what it is]

arrrg 3mo ago
ID cards aren’t exactly super standardized inside the EU. German ID cards have a RFID chip which basically contains all the same info that’s printed on the outside (PIN protected). Smartphones can read that chip and the state as well as private businesses could in principle use this to do age verification – even the super minimal version of age verification that just asks for a certain age threshold and gets a binary response whether that threshold is met. (Which to me if we can achieve it is the perfect solution.) The infrastructure is there and since 2017 those RFID chips are even actived by default when new ID cards are issued. (The cards are valid for ten years so nearly all ID cards have those active chips.) The biggest issue currently is a network effect one: hardly anyone is using the chip so people don’t create their initial PIN, creating a UX hurdle for adoption. (If you want to use your ID card chip you have to find your initial PIN somewhere in your documents – if you didn’t throw it away – and then create your proper PIN, you can’t just start using it.) I can sense usage increasing but exactly because of the poor initial use UX all sorts of private alternate solutions exist that are plain worse from a privacy preserving point of view. For example ones where you film your ID card from both sides (so the hologram is visible) which just suck. (You just share everything … which is just so unnecessary.) To change this we would need a policy that requires age verification without sharing the birthdate or any other PII.
- alistairSH 3mo ago
  Yeah, that sounds like the ideal solution. Unfortunately, we can't even get states to commit to our RealID requirements[1] (which doesn't even add a chip/PIN, it only strengthens validation of documents submitted at the time of application for a driving license). And the notion of a national ID is anathema to large swaths of the population. 1 - https://en.wikipedia.org/wiki/REAL_ID_Act https://en.wikipedia.org/wiki/REAL_ID_Act
3mo ago