Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EU Age Verification Project Mandates Hardware-Bound Attestation

linuxiac.com

Post reply on HN
Print view View original

61–70 of 206 posts

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#61

Post by jolmg »

audunw wrote: post #56
jolmg wrote: post #28

Earlier quoted context omitted.

> We restrict certain activities and places in the real world from certain people all the time. For example, not allowing people under 18 or 21 (depending on your country) into casinos. These are not equivalent. Restricting access to a casino just requires showing an ID to a person. A few seconds later and that person has completely forgotten everything about you. They will not keep a record of your home address, etc…

> You have no such guarantee when you upload government IDs to a server. The problem is that so many people here look at this purely from a USA perspective. An age check in many European requires no uploading of any ID. It’s an API call toward an ID service, it will tell you which data the service gets access to, and there’s strict regulations and liability around data retention. I’m not concerned about the governmen…

> The surveillance is implicit and hidden. If we understand that it’s nearly impossible for a non-tech person to avoid being tracked by corporations and governments, then we start working on the things that really help: super tight regulations about what can and can’t be tracked.

We can't get perfect privacy so we should normalize not having any? Leave it to the government we're distrusting to handle our privacy?

> If they become authoritarian enough to worry, they will impose far tighter surveillance anyway.

What is this logic? Let's not worry about creeping there because if they want it they'll force it? That's not how it works. Getting to a surveillance state needs acceptance. To get that, rather than dropping people in boiling water, you slowly heat the pot, which is what this is.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#62

Post by zenoprax »

WhyNotHugo wrote: post #2

> Linux is not explicitly banned. Desktop Linux users could access a website and scan a QR code using a supported mobile wallet. That's a weird way of putting it. You'll basically need a second non-Linux device if you want to use Linux. If your reason for using Linux is "I want to continue using old hardware instead of quickly-obsoleted devices", then you're shit outta luck: you'll have to buy a (potentially second)…

> The project’s position is that hardware binding remains required

I think you're downplaying the real risk: if TPM becomes necessary for any single routine activity (banking, communication, etc.) then the usability of any non-TPM hardware to access the internet approaches zero. What's the point of a Linux desktop that asks for attestation for every HTTP request? Or an Android phone that can't legally allow you to install APKs from beyond the Play Store?

I can't pay for things with NFC on my GrapheneOS phone because my bank doesn't trust the hardware. While this is a slight annoyance, it doesn't meaningfully affect my ability to use cards or type in numbers or authenticate with a fingerprint on my phone; however, the forced use of TPM to access anything should be rejected and protested at every step.

Encryption can never be stamped out, thankfully, but hardware is not within one's control: you get what is allowed to be sold.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#63

Post by matheusmoreira »

tzs wrote: post #60

It should be noted that this app is temporary. The EU is aiming for a digital wallet app that you can store your identity documents in and that you can use to prove facts about those documents to third parties, in a way where the third party gets no extra information--just what you chose to disclose (e.g., just your age or just your country) and that cannot be used to link your real identity to your using the site ev…

> It should be noted that this app is temporary.

Don't believe that for a second. Nothing is so permanent as a temporary government program.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#64

Post by matheusmoreira »

jmyeet wrote: post #24
big85 wrote: post #18

All this ostensibly to keep teenage boys from watching Pornhub (when parental controls already exist). The real reason, of course, is to force people to connect strong real-life identifiers to online activity. Mobile first, then Windows. Then Linux is too weak to oppose on its own, and will adapt or die.

That's a completely unhelpful, overly simplistic straw man argument. We restrict certain activities and places in the real world from certain people all the time. For example, not allowing people under 18 or 21 (depending on your country) into casinos. What we have now is essentially unrestricted access to pretty much anything and a fair assessment is that there is societal harm from that. We're creating gambling add…

> So saying "we should allow unfettered access to the internet" or even "it's the parents' responsibility" is naive, dismissive and has failed.

Absolute bullshit. This "unfettered access" is the whole reason why I am who I am today, why I am here. Not only did it not fail, it's in fact so successful it threatens the powers that be, and that's the real reason why they want to ban it.

> I personally believe that the easiest thign to attack is advertising to minors.

Now this I agree with. I would be even more radical. It's not just advertising "to minors", all advertising needs to get banned straight up. Advertising is mind rape. Ban it and all the problems with the web will be fixed literally overnight, including the problems "mandated hardware attestation" aims to solve. There is no need whatsoever for this attestation nonsense.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#65

Post by [deleted] »

knollimar wrote: post #42
jolmg wrote: post #28

Earlier quoted context omitted.

> We restrict certain activities and places in the real world from certain people all the time. For example, not allowing people under 18 or 21 (depending on your country) into casinos. These are not equivalent. Restricting access to a casino just requires showing an ID to a person. A few seconds later and that person has completely forgotten everything about you. They will not keep a record of your home address, etc…

do parents not control routers and cell plans? I feel like it would be easy to look here for header based solutions. They probably exist tbh. Then just ban your kid from VPNs.

[deleted]

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#66

Post by izacus »

matheusmoreira wrote: post #53
tzs wrote: post #32

Earlier quoted context omitted.

My understanding is that you are not forced to use this. Sites in the EU that will be required to verify user age will be free to use any method they wish as long as they can show it is as effective as the app and it does not violate privacy laws. Most analysts expect sites will offer multiple ways, for a variety of reasons. Eventually when the full EU Digital Identity Wallet is available age checks can be done using…

> Most analysts expect Total bullshit. There is no "effective" method without hardware remote attestation. If I control the system, I can just spoof whatever "verification" it is you're asking. The whole point of hardware attestation is to put a cryptographic key in the computer that the users can't ever get at, then use that key to prove the computer booted a corporate owned operating system that's 100% aligned with…

You can of course create an independent attestation database at any time and mandate its use - verifying that the custom OS you use fits minimum security requirements for digital ID use.

We use that approach in several other industries.

But.... that requires work beyond just complaining.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#67

Post by dgroshev »

akersten wrote: post #31
jmyeet wrote: post #24

Earlier quoted context omitted.

That's a completely unhelpful, overly simplistic straw man argument. We restrict certain activities and places in the real world from certain people all the time. For example, not allowing people under 18 or 21 (depending on your country) into casinos. What we have now is essentially unrestricted access to pretty much anything and a fair assessment is that there is societal harm from that. We're creating gambling add…

What's simplistic and unhelpful is falling for the narrative that infinite scroll, boobies, and algorithmic feeds are somehow more harmful than ubiquitous government surveillance of the most powerful communication tool on earth. The Internet, more or less, has been around 30+ years and the Something awful and 4chan generations are now in charge. We're not much worse off. The Internet is actually way tamer these days…

Algorithmic scroll is factually more harmful, regardless of the amount of harm as long as it's non-zero, because it does affect people. Surveillance on its own doesn't. It just doesn't, everything that you can think of in response is not solely or even significantly caused by surveillance.

Instead, limiting surveillance (which in this case is only linked to the issue at hand with what's explicitly a conspiracy theory, so the link is quite tenuous) was originally meant to limit the government's powers as a form of control over the government. Control over the government is just a part of the Enlightenment project of societies being able to shape their destinies equitably, which includes shaping political arrangements.

Americans have completely lost the ability to shape their political system (when was the last constitutional amendment passed again?), so instead the discourse turned to fetishising particular tools that might help, but were never the point of having freedom. This is a fallacy.

There are straightforward ways to have age verification without descending into a dictatorship. To use an analogy, most European countries have mandatory IDs, some even have digital IDs; many of those counties are freer than the US.

Freedom is being able to stop kids from accessing pornhub without fearing a dictatorship because you can just prevent the dictatorship through a million other means. Freedom is not paralysing the political system as technology and progress (and multi-billion dollar megacorporations) march on.

Otherwise societies just get superficial "freedoms" (like using slurs in public spaces because "free speech") while their governments, say, run a paramilitary murdering political opponents on the street.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#68

Post by txrx0000 »

afandian wrote: post #4

I don't understand where the all the EU anti-trust and anti-corruption regulators are here. _Governments_ enforcing that you have a Google or Apple account to participate in society is transparently absurd. This isn't only a digital sovereignty issue, it's also an anti-competition issue.

This is the correct intuition. The problem can be solved with antitrust by forcing hardware vendors to ship their devices without an operating system. Then the market will deliver the parenting solutions that don't require mass surveillance. We're currently being blocked from doing so by anti-competitive measures.

For a more detailed explanation of what the root of the problem is, see a past comment: https://news.ycombinator.com/item?id=49118578

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#69

Post by dgroshev »

jolmg wrote: post #61
audunw wrote: post #56

Earlier quoted context omitted.

> You have no such guarantee when you upload government IDs to a server. The problem is that so many people here look at this purely from a USA perspective. An age check in many European requires no uploading of any ID. It’s an API call toward an ID service, it will tell you which data the service gets access to, and there’s strict regulations and liability around data retention. I’m not concerned about the governmen…

> The surveillance is implicit and hidden. If we understand that it’s nearly impossible for a non-tech person to avoid being tracked by corporations and governments, then we start working on the things that really help: super tight regulations about what can and can’t be tracked. We can't get perfect privacy so we should normalize not having any? Leave it to the government we're distrusting to handle our privacy? > I…

Just a few decades years ago, everyone's names and phones in the US were freely available to anyone with a phone book. Communications were done in the clear, either via letters (hardly tamper-proof), or via phone (that anyone with access could tap).

Did every American live in a "surveillance state" back then?

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#70

Post by izacus »

xg15 wrote: post #22

> Linux is not explicitly banned. Desktop Linux users could access a website and scan a QR code using a supported mobile wallet. Considering a significant part of the internet will be behind age verification gates, how are they imagining this to work? I should pull out my iPhone or Google Android phone and get its approval every time I want to visit a website?

Most countries allow tapping your ID card to a reader device as well.
Post reply on HN