EU age verification app to ban any Android system not licensed by Google

"Device security checks" is the most horrifying aspect as it basically means "officially sanctioned hardware and software", and leads straight into the dystopia that Stallman warned us about in Right to Read.

There is some amusing irony in the EU relying on the US for furthering its own authoritarianism. It's unfortunate that freedom (in the classic rebellious, American sense) never became that popular in the EU, or for that matter, the UK.

You don't even need to consider politics to acknowledge this is dangerous, wildly irresponsible of a government to tie internet access to a foreign corporate entity's control. The privacy concerns of not being able to use a device free from Google services, may only be second to the sovereignty issues it introduces.

Whoops, Google have delisted your government app from the Play Store, how quickly can you de-couple your citizens internet access from the corptocracy?

So remote attestation?

> As a resident of the aforementioned political climate, I find their concerns to be reasonable.

No. The lesson is that stuff like this is concerning what ever the "political climate".

Anyway, you mainly don't want the gov in your vicinity to snoop. Non-local OS:es is probably advantageous in that regard if you choose to run proprietary code...

From the telegraph.co.uk: "Elite police unit to monitor online critics of migrants" and there are people worried about the "political climate" in the US lmao

>Especially in the current political climate I hope I do not have to explain how undesirable and dangerous that is.

this is not the way to make a point that the other party will find persuasive.

I heard from a friend last night that they were unable to see posts on X about current protests in their country because those were considered "adult" content which can now only be viewed after submitting to an ID check. Not porn, video of a protest.

You're 100% right that it's happening today.

There wont be any consequences if you expect them to legislate against themselves, or handcuff themselves and throw themselves into a cage.

Let's stop beating around the bush. We all know this doesn't make any sense.

They always start with "think of the children", but that's just the opening salvo. The wild west days of the internet are definitely behind us. We'll be lucky if we still have private personal computing in the future, or any semblance of free speech.

It's not accelerating, it's over. We lost.

Because of goomba fallacy.

The EU is not a hegemonic state, but rather an economic supranational organization. France/Germany tend to be primary proponents of increased EU strategic autonomy, while Poland/Czech/Baltic states are less supportive.

Similar to recent discussions of self-hosting, it's a tradeoff of autonomy/control vs efficiency.

> They flip flop on this stuff at least once a month

Because in the background it's a French vs German vs Irish vs Czech vs $insert_eu_state business interests competing with each other.

Notice how it's almost always French legislators and businesses that mention "domestic EU tech" and not Polish, Czech, Romanian, Dutch, or even German policymakers or businesses?

That's why.

National interests always end up trumping the EU in it's current form. And for a large portion of the EU, American BigTech represents the majority of FDI (tech and overall).

Japanese and Korean automotive players did the same thing with the US in the 1980s-90s in order to ensure their interests remained aligned (though the Plaza Accords did play a role)

EU is a great chihuahua, authoritarian laws get passed, national politicians say that there's nothing they can do, but they benefit greatly from all the new posibilities of control over the internet.

I mean.. great for the politicians, not for an average european.

95% of Europeans are running American OSes today. Should age verification just wait 20 years for EurOS to be deployed?

If they could have stopped BitTorrent they would have long ago.

So no, this is totally ineffective. And it's not like there's actually a problem. There's no crisis of messed up kids or young adults. We all had access to porn in some form and we all turned out fine. I used to watch the late night pay tv which was just 'scrambled' by removing the sync signal. It was easy to put that back with some electronics chops. I saw my share of gangbangs and cumshots and I did not get messed up or get weird ideas. In fact I often get compliments I'm a sensitive and caring lover.

So did most of my school friends. Also video tapes got passed on at school and later CDroms (when the writable DVD came I was already an adult).

This is all to mitigate a "crisis" which doesn't actually exist.

It seems reversed, that the default is legal eligibility, and that minors should need to prove their status. They're the ones who need policing, after all, not us.

For instance, it's not illegal for me to be served alcohol. If I'm not carded when being sold a drink, nothing illegal has taken place.

If the lawmakers are being cowards and not saying they want to round up and ID all the children from birth until they are eligible to participate in the adult world, that's their battle to fight and not our burden.

>but fail to block tech-savvy children.

If I were a kid, I could see myself downloading Opera GX and enabling the free VPN. It's probably not "tech-savvy" because the browser gets a lot of ad views on YouTube; it would be pretty obvious.

I think social media does more damage than porn. We should just instead legislate that all social media has to shutdown and just let everyone watch porn and be done with it. Sure, you wind up with ED if you watch that stuff since you were a kid, but hey, if birth rates around the world are anything to go by, no one seems to really want to bring children into this world anymore anyway, so it's not as if that actually matters anymore.

I think I have become far too cynical.

I keep coming back to the actual solution being to keep kids off the internet period. If you are under 18, and online without some sort of adult supervision, we have failed you. Maybe that ship has sailed with so much coursework requiring online access, but I maintain that perhaps we should declare it lost at sea and try again.

Because the practical reality here is, like, porn is the big scary word, but the actual danger to kids is *other people.* Other addictions still exist. Removing one vice without solving the underlying systemic problem merely shifts the goalposts, and everyone is up in arms about what a slippery slope that is for good reason.

EDIT: Clarity here because I phrased that badly in a hurry: I'm in disfavor of internet access being a requirement for schoolwork, but I failed to set that context initially. If parents trust their kids enough with access, once they've reached a certain point of maturity, that's fine. I'm against technological age gates and I'm against removal of bad content from the net at large. Parents should decide when their kids are ready, and guide them appropriately.

I will leave my original remarks unedited so the remaining discussion is sensible. (Sorry!)

It is amazing. All the US companies have to do is dangle a “free” solution and the EU will go for it, and then be all surprised pikachu at the terms they agreed to.

Where do you get from that we are capable of doing it ourselves? All EU-made software I've used was terrible, and the one that was a bit better than terrible was bought by a US company.

You need a pile of money first. And that works differently in the EU.

The only will you get from EU is to protect incumbents and the only plan is to make another centrally planned fund that distributes money to chosen entities. EU is very good at removing the carrot while wielding a big stick for would be entrepreneurs.

Lack of capital. Fear of consequences.

Google rolls into town and wants to spend half a billion euro on a datacenter? Sure thing. They'll say that it'll boost the local economy while being built - by creating a couple of thousand jobs for the contractors that are going to build and maintain it, and then some onsite jobs for the next decade or two, creating a couple of hundred jobs for techs / engineers.

And as long as they keep playing ball with google, projects like that will pop up once in a while. If you're difficult, there's also a risk of the rich tech companies taking their business some other place.

With that said, I've recently noticed more voices for building our own stuff - as there's a real risk that US tech companies will simply comply if pushed enough, say, by a POTUS that's out for blood and wants to hurt certain foreign users. Ban/lock out certain users from gaining access to software, turn off their infrastructure, etc. who knows.

But, alas, there just isn't the same willingness to pour in capital on the important things. For private investors it doesn't make much sense, unless they have a bulletproof contract with domestic users willing buy their service - and using state funds isn't too popular, either.

Truth be told, any of the big tech businesses can undercut any competition, and probably build better and faster. If anything, it could be the case for tariffs - outsourcing critical infrastructure will leave you very exposed. If European countries all over the board started to abandon US tech companies, they'd cry to Trump, who in turn would probably start a trade-war.

Because politicians are corrupt

Because national interests always end up trumping the EU in it's current form.

American companies like Google [0][1], Amazon [2][7], and Microsoft [3][4][5][6] have spent billions in FDI and hiring, thus building strong relationships with EU states like Ireland, Romania, Poland, Finland, Sweden, and others, but French and German competitors haven't (or don't exist depending on the service or SLA).

This means a significant portion of EU member states have an incentive to maintain the relationship, because the alternative means significant capital outflows. A Polish legislator doesn't have to answer to French voters, so they will incentivize the relationship with BigTech. Thus, these nations will lobby tooth and nail against destroying the relationship.

It's the same reason Hungary courts Chinese FDI [8] and enhancing the Sino-Chinese relationship as leverage against the EU pushing too hard [9].

[0] - https://www.gov.pl/web/primeminister/google-invests-billions...

[1] - https://www.gov.ie/ga/an-roinn-fiontar-turas%C3%B3ireachta-a...

[2] - https://www.aboutamazon.eu/news/job-creation-and-investment/...

[3] - https://centraleuropeantimes.com/microsoft-google-invest-big...

[4] - https://www.reuters.com/technology/nordics-efficient-energy-...

[5] - https://www.idaireland.com/latest-news/press-release/an-taoi...

[6] - https://www.government.se/articles/2024/06/prime-minister-to...

[7] - https://aws.amazon.com/blogs/industries/cloud-technology-emp...

[8] - https://hungarytoday.hu/hungary-seeks-to-stay-leading-europe...

[9] - https://theloop.ecpr.eu/hungary-and-the-future-of-europe/

It's largely a political issue. At this stage you can't create alternatives to Google and other U.S. tech giants without removing them from the market (so essentially the Chinese approach, which has allowed them to build their own massive tech giants). But that path is nearly impossible for the EU due to the risk of U.S. retaliation. The EU can't even implement a digital tax.

You also can't just say, "Here's a few hundred billion in public support to create alternatives to U.S. tech giants", because the U.S. would argue that it's unfair state aid and retaliate.

There isn't enough private capital in the EU with the risk tolerance required to take on such a challenge independently.

We also lack a reserve currency like the USD, so we can't print $2 trillion a year, much of which ultimately flows into the U.S. stock market and further boosts U.S. tech companies, making competition even harder.

EU markets are already fully penetrated by U.S. behemoths that can either withstand or acquire any privately funded competitor, thanks to their massive cash flows and valuations.

For all these reasons, the outlook isn't very promising.

The only winning move is not to play the game. One has to have a phone these days but you don't have to do your computing on it (during personal time). Use a real computer instead.

It's not a tech issue, it's a regulation issue.

EU wants to push more control on the internet, today it's "think of the children" but when the infrastructure is rolled out, it'll be "real name verifiction" on social media, chat control, etc.

Whoever is pushing this in EU has to be removed before things will get better.

> if this verification wasn’t in place, could I just alter the source code or binary to always return “yes I’m 18” (or whatever) and completely subvert the intent of this tool?

Kinda, yes.

(slightly simplifying the mechanism here)

This seems to be based on the EU Wallet project, which is still work in progress. The EU wallet is based on OpenID (oidc4vci, oidc4vp). The wallet allows for selective disclosure of attributes. These attributes are signed by a issuing party (i.e. the government of a EU country). That way a RP (relying party) can verify that the data in the claim (e.g. this user is 18+) is valid.

However, this alone is not enough, because it could be a copy of that data. You can just query a wallet for that attribute, store it and replay it to some other website. This is obviously not wanted.

So the wallet also has a mechanism to bind the credential to a specific device. When issuing a credential the wallet provides a public key plus a proof of possession of the associated private key (e.g. a signature over an issuer-provided nonce) to the issuer. The issuer then includes that public key in the signed part of the credential. When the RP verifies the credential it also asks the wallet to sign part of the response using the private key associated with that public key. This is supposed to prove that the credential was sent by the device it was issued to.

Now this is where the draconian device requirements come in: the wallet is supposed to securely store the private key associated with the credential. For example in a Secure Enclave on the device. The big flaw here is that none of this binding stuff works if you can somehow get access to the private key, e.g. on a rooted phone if the wallet doesn't use a secure enclave or with a modified wallet app that doesn't use a secure enclave to store the private key. You could ask a friend who is 18+ to request the credential, copy it to your phone and use that to log in.

I'm pretty sure all you need is the ability to login to a website and for that site to vouch for your age based on having examined your identification documents (or something like a network of PGP web-of-trust type notaries). I have a hunch that using a hardware token and biometrics is required to prevent fraud (FIDO and passkeys etc should work). The trick is preventing simulated tokens from existing/working which is where secure boot etc enter the picture.

You would need to release a kernel and OS that requires users who modify the attestation and hardware token components of it to provide their own signing key rather than your production EU-registered one, chained back to the HSM signature emitted by the phone’s HSM signed bootloader; and then you would simply let the app check that its secure boot attestations chain to a secure bootloader/image/OS triplet that’s on file with the EU. Mix in some tech spice for the EU to prohibit OS releases that are validly signed but whose specific instance of a signature is found to be exploitable to bypass age checks and you’re set. None of this would prevent users from modding their devices, any more than macOS prevents modifications today if you turn off the security protections; but once you turn off the security protections, it can no longer attest with Apple’s signature because your modifications don’t match the signature any longer, and so Apple Wallet is inaccessible.

None of this prohibits users from modifying their bootloader, kernel, or OS image; but any such modification would invalidate the secureboot signature and thus break attestation until the user registered their own signatures with the EU.

The EU currently only transacts with Google in this regard because, as far as I know, they are the only Android OS publisher (and perhaps the only Linux publisher?) that bothered to implement hardware-to-app attestation chaining live in production end-user devices in the decades since Secure Boot came onto the scene. All it takes to change that is an entity who has sufficient validity to convince them that outsourcing permitted-signature verification to Google is unethical, which it is.

It’s a safe bet that Steam Linux was already working on this in order to attest that the runtime environment is unmodified for VAC and other multiplayer-cheating prevention systems in games — and so once they publish all that, I expect we’ll find that they’ve petitioned their attested OS signature chain to the EU as satisfying age requirements for mature gaming.

The vendor lock-in here is that Apple and Google and, eventually, Valve, are both willing to put the weight of their business behind their claims to the EU that they do their best to protect the security of their environment from cheaters, with respect to the components required by the EU age verification app. The loophole one could drive a truck through that the EU has left open to break that lock-in in the future? Anyone can petition the EU to accept attestations from their own boot-kernel-OS chain signatures so long as they’re willing to accept the legal risks visited upon them if found to have knowingly permitted exploitation for age check bypasses, or neglected to respond in a timely and prudent manner when notified of such exploitability by researchers — and if the EU rejects their petition improperly, they’ll have to answer for that to their citizens.

> Who the hell wants this Internet...?

The under educated, unthinking unwashed masses. Just look at the tea leak. The amount of people that do not care about freedom or privacy on the internet vastly outnumber those that do. And because they do democracy unmasks itself in the digital realm as the tyranny of the unthinking majority.

Weep for the future.

> Who the hell wants this Internet...?

Scared rich people and bureaucrats

It's more likely to be laziness by the developers.

> Unless their governments start issuing Android devices to all of their citizens, I don't understand how they can require use of this app for anything official.

Not sure who you mean by "they" but you already cannot use a lot of governmental services unless you have an Android or iOS device (at least in Austria). At least in practice that is almost impossible.

They will support iOS and Android which covers 99.9% of the population.

Even if they can't be traced back to a name/photo identity, it would still be a privacy disaster if you could only make one proof per service.

If a user can only make one then they'll have to use that identity with that service forever. That's a nightmare for privacy. Sometimes people need another account, unknown to their employer/family/friends. People should be able to make multiple accounts without those being tied together through a common "age check" identifier. But, of course, there is no way to prevent those from being distributed.

At some level I believe that's the purpose behind some of this. If someone can only have one proof, then someone can only have one account to speak with. They'll be easier to monitor, easier to identify, easier to silence. That's why I think these types of laws and behaviors should be resisted and protested.

I've mentioned in a previous comment that it's telling that big tech isn't resisting these totally-just-coincidental ID laws coming from western countries. It supercharges their surveillance and tracking abilities, and widens their moats.

Also, porn is a smokescreen. The definition of "adult" content will rapidly expand, and these put the ID issuers in censorious a position of control over people and services. Nothing stops a government attestation server from rejecting a request because someone is blacklisted from "mass communication services" because they're a felon, protestor, LGBT activist, etc... or because a service has fallen out of favor.

The technical specification can be found here[1], with further details here[2].

Well, it's more like a framework, so not a ton of details. I've just glossed over it, but from what I can gather they have thought about it:

No personal data, especially no information from personal identification documents such as national ID card, is stored within an [Age Verification App Instance]. Only the Proof of Age attestation, specifically indicating "older than 18", is utilized for age verification purposes

Stored Verification(8b): [Relying Parties] may optionally store information derived from the Proof of Age attestation in the User's account, allowing the User to bypass repeated verification for future visits or purchases, streamlining the User experience. In this case, authentication methods such as WebAuthN should be utilised to ensure secure access while enabling the User to choose a pseudonym, preserving privacy. Risks in case of the device sharing should be considered.

[1]: https://ageverification.dev/Technical%20Specification/archit...

[2]: https://ageverification.dev/Technical%20Specification/annexe...

This is the pr on it [0]. It was linked on hn at the time too [1]

For all the shit Google deservedly gets they seem to be genuinely trying to implement good and privacy preserving solutions to a lot of these problems.

The issue of course is that there's essentially no way to do all this stuff with software and hardware the user actually controls themselves, so you end up with hard requirements that you use big tech as gatekeepers.

This is the slippery slope that IMO eventually ends the open web.

If you take that outcome as inevitable, which at this point I basically do given all the forces lined up to restrict access to information, I suppose Google is about the best steward you could hope for.

[0] https://blog.google/products/google-pay/google-wallet-age-id...

[1] https://news.ycombinator.com/item?id=43863672

The idea is, that you have a 'digital ID' on your phone, tied to your real identity, that will today be used to prove you're 18, but when the infrastructure exists, it will be used for other stuff too... like needing to attach your real name to any social media account (you already have an app that does that on your phone for the 18+ thing, so adding real name is easy to implement), and that will greatly affect freedom of speech.

Yeah, EU byrocrats love corporate overlords in real life

I mean there's a perfectly rational possible explanation for this - if the fines are actually just an extra targeted tax on these companies (but it's politically inconvenient to just do it honestly by levying a tax), and they would therefore adjust the laws to make sure they could still fine them if they had already complied...

It may be that the people in charge in the EU don't really care about the market dominance as long as they can collect enough extra money from them...

At the time this comment was posted there was only one other comment in this entire thread.

You say “so many people are advocating for this in HN” but this thread was empty except for one other comment (which was also critical of this) at the time you posted your comment.

> it's so clearly a draconian slippery slope for invasive surveillance and choice restriction

It's a privacy preserving over 18 check.

Is it a "slope"? Sure, you can imagine an extension to the system that is "worse".

Is it "slippery"? This thing isn't draconian enough to be effective. It will be a minor speedbump that prevents exactly zero determined under-18's from accessing anything that they'd want to. So then the question is, does the government react by trying something more draconian, or does it give up?

I don't think you are fully wrong, but the issue is your rhetoric is very much used by conservatives or "both sides are bad" which are just mask-on conservatives who end up voting the same way. And the problem with conservatives is not really the ideals and ideas, but the fact that they vote Republican (or whatever the equivalent party is in other countries), that all pretty much are the exact opposite of those ideals.

Age verification is already a thing IRL, there is no reason to not extend it online considering so much of our lives is digital. Overall I think anonymity should be reduced on the internet in general - a big reason of the world issues, especially in USA is that ideas can grow in forums where people under etherial identities can tell lie after lie without any repercussion.

It's just information. Data. Bytes. We need a proper George Orwell for the digital age.

The internet used to be a bastion of freedom. That era ended around 2005.

What if the data stays on the phone?

> No evidence is given that they won't implement non-Google remote attestation solutions like https://attestation.app/about

Unfortunate that it doesn't matter, because they're not going to accept anything that's not attested by some authority.

Attestation in itself is a bad thing, guaranteed to be horrifically abused in ways far, far worse than any problem it could possibly solve. You do not need to know what software I am running, period.

No evidence is given they will.