HN Reader

In the case of Android, genuine means:

    The operating system was licensed by Google
    The app was downloaded from the Play Store (thus requiring a Google account)
    Device security checks have passed

While there is value to verify device security, this strongly ties the app to many Google properties and services, because those checks won't pass on an aftermarket Android OS

The issue is being raised here: https://github.com/eu-digital-identity-wallet/av-app-android...

    I would like to strongly urge to abandon this plan. 
    Requiring a dependency on American tech giants for age verification
    further deepens the EU's dependency on America and the USA's
    control over the internet. 
    Especially in the current political climate I hope I do not have
    to explain how undesirable and dangerous that is.

As a resident of the aforementioned political climate, I find their concerns to be reasonable.

There are a number of comments in that same thread that indicate a mandate to utilize Google services may run afoul of EU member nations' integrity and privacy laws.

So many people advocating for this in HN and elsewhere when it's so clearly a draconian slippery slope for invasive surveillance and choice restriction. After these things get implemented people pretend it was always like this.

We don't need the governments to mass surveil us to protect us. We need them to sort the economy and stop invading countries and being deferential to corporate interests instead of the people they represent.

It's such an obvious push that If you don't want to see it, it makes me think you're shielding yourself to avoid contending with the reality: These politicians and govs all around, including the countries you claim "work" are absolutely power hungry and beholden to interests other than yours and will push for as much total surveillance as they can, including as much curtailment of freedoms as they can.

Obviously that won't mean elites will actually face justice or crimes will actually be solved because more surveillance is not accompanied with more government transparency, quite the opposite and bigger and more powerful burocracies, with more authoritarianism, allow for easy hidden exceptions that you can't question.

It's nothing new. Corruption is common. It's just mediocre to see "hackers" pushing for it just because the government and corporations tell them to, because foreign country bad, bad social media influences kids, drugs, word-ism, etc.

The European union never ceases to amaze me. Whatever happened to becoming less dependent on American corporations?

They flip flop on this stuff at least once a month, and the most annoying part is that they always herald everything they do as some new epoch-defining initiative only to quietly forget about it and do the opposite a few months later.

If nation states are dogs, then EU is the chihuahua: loud, proud and extremely ineffective.

For those wondering what the purpose is: https://ageverification.dev/Technical%20Specification/archit...

https://ageverification.dev/Technical%20Specification/media/...

Essentially, the core user journey is a privacy preserving "over 18" check. I suppose this prevents under 18's from accessing porn, in the same way that most blocking technologies impose an expense on everyone but fail to block tech-savvy children.

Doesn't seem like it could ever stop someone with a bittorrent client, unless you have to attest you are over 18 to even use bittorrent.

The war on the free internet is accelerating. Without real push-back to these dystopian laws and consequences for the people proposing and lobbying for them, you'll miss what will ultimately end up being a temporary anomaly of mostly unrestrained free flow of information. It's not an hypothetical scenario or something that will develop down the line, it's happening today, worldwide.

Asking my EU friends, why do you let yourselves be bamboozled by the US tech companies when you’re totally capable of doing it yourselves?

Seriously. You don’t need Google. You just need a plan and a will to execute.

Unfortunately this isn't the first time a government has banned Android devices which are not licensed by Google. GrapheneOS has a list of them[1]

[1] https://grapheneos.org/articles/attestation-compatibility-gu...

Without getting into the ideological weeds too much, is there a solid technical reason for this? Like if this verification wasn’t in place, could I just alter the source code or binary to always return “yes I’m 18” (or whatever) and completely subvert the intent of this tool? If so, is there a straightforward way to prevent this without involving Google?

Ugh. There's just no winning with tech anymore.

I use GrapheneOS as a daily driver and I absolutely love it. It should be the default. There's already one app I use that must do something similar and absolutely just won't run on it, so I have an entirely separate phone running stock Android just for that one app. Still worth the hassle.

Glad I don't live in a place where all this madness is taking root, but still, the trend itself sucks.

This has nothing to do with age verification, but everything to do with identifying users on various services. They can compell the providers of said services to give them access to how each, now identified, user is using the service. Since a lot of our lives are digital, this is a major transfer of power from the people to a select few.

A question I have is who voted for this? I sure didn't.

I am not sure if I am more disturbed by the user journey they want to introduce for accessing websites or the fact that a private company (american, chinese, I don't care) has to become the gatekeeper to let me in.

Who the hell wants this Internet...?

What an absolute clown show - the EU fines Google and Apple for being monopolistic and abusing market power and then proceed to implement apps like these that can only be used on American operating systems.

Seriously you can't make this stuff up.

A URL without requirement to login to Reddit:

https://old.reddit.com/r/degoogle/comments/1mau7yl/eu_age_ve...

I'm getting pretty tired of the EU trying to shove internet-crippling regulations down my throat. This, along with ChatControl, is clearly a path towards totalitarian control.

Who are the politicians making these decisions? How did they get elected? Did anyone vote for Totalitarianism 2.0?

What kind of services will use this app?

Unless their governments start issuing Android devices to all of their citizens, I don't understand how they can require use of this app for anything official.

"age verification app," is such a phony pretext. They know that android fragmentation and the lack of consistent verifiable hardware is what prevents govts from implementing a punitive digital ID that is sufficient to punish and fine people using western standards of evidence and legal defense.

these people are monsters. don't help them, and don't be complicit. working on digital ID tech, and even disclosing vulns in it is like helping Hollerith make faster and more efficient punch cards.

EU: "We need to decouple from the independence of the US". Many (local and national) entities proceed to ditch Microsoft for it.

Also the EU: Well if you don't have a Google or Apple account you are not getting age verified.

> EU age verification app to ban any Android system not licensed by Google

Oh, so now we know who is pushing for age verification. FAANG

This collision course has been a long time brewing, though I'm not even sure why integrity checking is included in this. The data source for the age information is the governments, there's no need to trust the clientside per se, it's just a middleman.

One thing I find reassuring is the nature of pushback on display on the repo (only read the first few comments there, mind you). Really not what I expected phrasing and rhetoric wise (unlike here), honestly kind of restored a very very tiny and fragile bit of faith in humanity in me, it's very reserved and reasonable stuff.

Lengthy GitHub issue about this: https://github.com/eu-digital-identity-wallet/av-app-android...

It really seems like tying this to Google violates some key principles of the EU market.

No evidence is given that they won't implement non-Google remote attestation solutions like https://attestation.app/about

Indeed, the bug links to another bug where the author says that it isn't restricted to Play Services remote attestation and recently followed up with a documentation update making that clear. https://github.com/eu-digital-identity-wallet/eudi-app-andro...

Looks like someone just got a really cushy job at Google when they retire from leading this system.

If you're wondering what regulatory capture looks like, this is it.

The problem isn't being handcuffed by Google or an American company, it's being handcuffed at all. Is it some kind of psychological coping skill to misdirect from the obvious problem (an age verification app that bans user software preferences)?

Who cares if it's Google or an American company. The point is you decided to let the E.U dictate what software you can run on your phone.

Play Integrity API requirement dropped: https://github.com/eu-digital-identity-wallet/eudi-app-andro...

Does anyone know how this is implemented?

If the proof can not be traced back to your identity, then what stops a person from creating large amounts of proofs and distributing them?

If the proof can be traced back to your identity, then... that would suck.

This is a problem that needs to be solved. I guess we should have solved it before the regulators got involved, alas, here we are.

A while ago, when the topic of the EU digital ID was brought up, I said clearly that this was going to be shit-show and that the intent was going to use this as tool to muzzle the population.

It turns out I was right. This is the intent. First require digital ID to access content/post anything on social media, then make it impossible to use said ID outside of the walled garden of Android and Apple, then tie this digital identity to your real world ID and make sure it can be revoked at anytime by the powers that be.

Bonus point, make sure everything you say or do is stored for unlimited access by law enforcement to protect the democracy(TM) or protect the children(TM).

If that is not a slippery slope, then I don't know what it is.

I also pointed out that creating a database of everyone in the EU containing a lot of PII in terms of religious preferences, sexual preferences and so on is a the stupidest idea that anyone could have considering that this tool could be used by the next parties in power to hunt down political/religious opponents.

Nobody can say that they did not know.

I think this misses the forest for the trees. I could care less if the app requires a Google Android phone or non-jailbroken iPhone to work. I care that age verification exists in the first place, when it most definitely shouldn't. Arguing and ranting about how a huge privacy compromise functions misses the point that privacy is being compromised.

It's just odd to see them bringing up America when their own government created this. Not the US. How about fight the actual problem instead of making sure the problem works on more devices.

The title of the submission is misleading.

The linked Reddit discussion is about the issue of attestation in the EU age verification application requiring a licensed version of Android to function properly.

The EU is not banning non licensed Android systems. This would make it hard for EU citizens to use those though, if they need that app.

I don't understand what device verification is even meant to do here. What's the threat model of a child who knows how to root their phone and defeat verification checks manually but doesn't know how to find an adult to create an account and give them the password?

I never want to read about how the EU “cares about people’s privacy” unlike the evil US

This is ridiculous but it's worth pointing out that if the EU would provide their own infrastructure for "age verification" it would be even more Dystopian. The problem is not really that the EU in this case would give Google and Apple monopolies that locks out all competition, the problem is the "age verification" itself. Nobody needs, nobody wants it, and it's the starting point for all kinds of browsing and chat control measures dictated by governments.

Sure, so much for freedom of choice and twisting people's arms. What is it their fucking leaders sing about being freedom loving and democratic?

I wonder if this requirement stemming from the recently announced trade deal with the US.

With the vassalisation of the EU, this is yet another prof that the European Commission and some other countries follow what the US wants.

Bad deal all along.

Lol. People put way too much trust in governments.

If it's not unbelievably obvious, there's an entire class of people flying private jets to "world summits" where the transcripts aren't disclosed. What do you think is going on? Use your brain.

I know you can’t access the Internet but at least you can use USB-C. Europe LOL!

It's absolutely abysmal that the EU and UK are implementing laws relating to age verification requirements.

Who voted for this? Who asked for this?

Internet has become a commidity that needs to be reinvented with a focus in the real human interactions and the privacy.

How?, who?, Where? I'm afraid it is too late to find a group of people interested in creating a real network outside of the system. The best that i found was the LoRa communities but are useless for anyone submerged in the Tiktokian distopy.

I don't understand how the poster of the message goes from the disclaimer tet:

> The current release provides only basic functionality, with several key features to be introduced in future versions, including:

> - App and device verification based on Google Play Integrity API and Apple App Attestation

> - Additional issuance methods beyond the currently implemented eID based method.

> These planned features align with the requirements and methods described in the Age Verification Profile.

to the "In the case of Android, genuine means"...

I don't see the word "genuine" in the disclaimer. Is that a necessary part of using the "Google Play Integrity API" ?

(I'm genuinely asking, I feel like I'm missing some implicit context here.)

What "things" are going to depend on this Android-locked age check? What about Apple users? What about accessing it via a laptop or desktop (shock horror: running Linux!)?

My dad gets by in his "my dad" way of life without a mobile phone at all, I wonder how much longer this will be possible. I was about to rant about being forced to have a mobile if you want to participate in society, but then he uses a desktop for some of the services for which the rest of us use a mobile, so my rant falls down in that, for a while now, to participate in society you've needed either a computer or a mobile.

Hopefully computer-only can eke out some kind of base-adequate participation for a while longer.

You can't use device verification in production anyways. (ATM)

This has no effect, is it even used in production anywhere? It seems to be part of eIDAS which is a good thing, most countries already have their own identity systems as is stated in the README. The three or for id apps I have seen all have some kind of device check that is sent to the ID provider, it is not usually accisible for ServiceProviders though. On those apps you either get no indication or just a "seems suspicious" score.

The one in Sweden has a "return risk option". https://developers.bankid.com/api-references/auth--sign/auth

This does not make it possible to filter out people. And honestly considering the amount of shady phones people have I am not sure this will every work. Apple is sadly another issue, too many normals there.

It is nice that this is pointed out so we do not get a distopian future.

Funny how EU politicians complain about dependency on American tech and the next day do something like this. It's all cheap talk anyway as they have 0 intention to make EU based alternatives possible but it's rarely in your face so much.

At the end of the day someone could always grab this code, remove the verification step, and distribute that as a new app.

I guess GDPR is on the way out, unless Google pinky promises to keep all processing/data local to each EU state?

Europeans, fighting for European sovereignty, bowing down to Google and Microsoft

How sad is that, Europeans, you have fallen this low

Will this be the end of kyc companies like veriff, onfido, jumio, trulioo and whatever else is this crowded space in europe?

Will people sign up to banks and betting apps with their eu wallet digital identity?

We shouldn't need Age Verification checks for adults in the first place.

Create a better, standardized, open-source parental control tool that is installed by default on all types of device that can connect to the web.

The internet aspect of the parental control should be a "Per Whitelist" system rather than Blacklisting. The parents should be the ones to decide which domains are Whitelisted for their kids, and government bodies could contribute with curated lists to help establish a base.

Yes, there would be some gray area sites like search engine image search, or social media sites like Twitter that can allow you to stumble into pornography, and that is why these devices that have the software turned ON, should send a token through the browser saying "Parental Control". It would be easier for websites to implement a blanket block of certain aspects of their site than expect them to implement whole ID checks systems and security to make sure that no leaks occur (look at the TEA app) like the UK is expecting everyone to do.

Also, I'm for teenagers (not little children) having access to pornography. I was once a teenager, every adult was, and we know that it's a natural thing to masturbate which includes the consumption of pornography for most in some way. Repressing their desires, their sexuality, and making this private aspect of their life difficult isn't the way. Yes, yes, there is nuance to it, (very hardcore/addiction/etc) but it should be up to the parents to decide with given tools if they trust their kid to consume such a thing.

As for the tool itself. Of course we have parental tools, but they can be pretty garbage, their all different, they're out of the way, and I understand that many people simply don't know how to operate them. That's why I believe that creating a standardized open-source project that multiple governments can directly contribute to and advertise for parents is the way, because at the end of the day, it should be up to the parents to decide these things, and for the government to facility that choice.

Obviously, besides the internet aspect, the tool should have all the bells and whistles that you'd expect from one, but that's not the topic.

EDIT: And yes, some children would find a way, just like they're doing now for the currently implemented ID checks. It's not lost of me that VPNs with free plans suddenly exploded in 4 digits % worth of downloads. A lot of those are tiny people who are smart enough. Or using an app like a game to trick Facial Recognition software.

> [...] free flow of information is the only safeguard against tyranny. [...] Beware of he who would deny you access to information, for in his heart he deems himself your master

A lot of discussion, but one contradiction seems to have gone unnoticed; notably, the EU's DMA decision about Apple having to allow alternative app stores. Go figure again about these contradictory moves.

The first comment was hilarious: "so how does one report the EU for breaching GDPR" and it reminds me of a comment on r/androiddev where Google was requiring solo devs to have a verifiable phone number for support and the commenter said something like: "Meanwhile, Google itself do not have a support phone number for his Android devs!"

who do we contact for this mess?

Any EU friends can tell me which politicians are behind this?

Wow, kids are installing random operating systems from internet into their phones right?

All by design :)

There is a correct cryptographic solution for information verification online:

https://news.ycombinator.com/item?id=43715884#43722778