Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EU Age Verification Project Mandates Hardware-Bound Attestation

linuxiac.com

Post reply on HN
Print view View original

91–100 of 207 posts

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#91

Post by dgroshev »

jolmg wrote: post #87
dgroshev wrote: post #75

Earlier quoted context omitted.

So what? Some things are exceptionally hard to track now (like e2ee messages) that were trivial to track back then. Every remote communication could only be had in the clear. Everyone was fine with that. Was the US in the 80s a surveillance state?

Back then there was only the possibility of listening-in on particulars, and even then people did worry. They weren't fine with that. That's why there's wiretapping laws enacted in the 80s. Today, and as things continue to progress with speech-recognition, LLMs, video recognition, etc. surveillance can be automated. It's looking conceivable to be able to process all communication population-wide in real-time. That wo…

You just said it yourself: the perceived danger of overreach was averted through new laws and control over what the government is doing.

If citizens still have a capacity to restrict the government via (enforced) laws, it doesn't matter much that the communications are in the clear. You can layer something on top just to be sure, but the foundation is laws and a functioning political system.

If there's no functioning political system, the government will just do whatever, like buying the same data they ostensibly can't collect from commercial providers (who weren't restricted from collecting it because there's no US GDPR).

If a country has a functioning political system, it can just do things like ban gun ownership, introduce mandatory IDs, publish everyone's yearly income, or criminalise calling other people slurs in public and not become an uncontrollable dictatorship. If it doesn't, corruption and democratic backsliding will happen regardless. Hyper-focusing on a few tools and superficial traits of a particular system in a particular moment is myopic.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#92

Post by mindslight »

SecretDreams wrote: post #34
akersten wrote: post #31

Earlier quoted context omitted.

What's simplistic and unhelpful is falling for the narrative that infinite scroll, boobies, and algorithmic feeds are somehow more harmful than ubiquitous government surveillance of the most powerful communication tool on earth. The Internet, more or less, has been around 30+ years and the Something awful and 4chan generations are now in charge. We're not much worse off. The Internet is actually way tamer these days…

Don't know about boobies, but I would guess META/other infinite scroll products are this generation's cigarettes in terms of long term harm and we do a severe disservice to all young people that are exposed to this product. Moreover, asking parents to intervene is obviously not going to work because they, themselves, have been partially ruined by it and lack the critical thinking required to intervene and the prowess…

> continuing the status quo with social media is a non starter for humanity. So tell me how we can help kids not get ruined by the internet without a mechanism specifically identifying that they're online

What if I told you it's very simple? We work at banning the harmful dynamics of corporate social media for everyone [0], rather than beating around the bush about kids. In fact, trying to avoid this is exactly why Faceboot et al are lobbying for this age verification crap in the first place - to escape the one tiny avenue of liability that has managed to exist, so they can keep kicking the can down the road.

Given how wholly top-down these proposals all are, frankly they would be better off being referred to as "give control of what your kids can see to the judgement of corporate attorneys.

[0] antitrust enforcement would go a long way here. Faceboot operates on online hosting service, so they should be prohibited from anticompetitively tying the client software used to access it (which necessarily includes "the algorithm").

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#93

Post by zarzavat »

filleokus wrote: post #47
WhyNotHugo wrote: post #2

> Linux is not explicitly banned. Desktop Linux users could access a website and scan a QR code using a supported mobile wallet. That's a weird way of putting it. You'll basically need a second non-Linux device if you want to use Linux. If your reason for using Linux is "I want to continue using old hardware instead of quickly-obsoleted devices", then you're shit outta luck: you'll have to buy a (potentially second)…

If you want to actually enforce age restrictions that can be checked via some kind of digital identity I don't see how we can avoid the "trusted" hardware requirement. The key material must be DRM'ed, especially if some ZKP solution is used. Otherwise all underage kids would download the cool older brothers private key and load it into their GNU Taler client, buy wine and be gateway'ed into heavier Stallmanisms. Befo…

Xkcd 538. Hardware attestation is not required because it's not sufficient, you need to plug all the other much easier ways to get around the system.

Firstly, you need to comprehensively ban VPNs, probably with some great firewall setup.

Secondly, you need to install CCTV in people's homes to make sure that nobody uses someone else's device to get around the system.

Then it's time for hardware attestation.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#94

Post by throw-the-towel »

pembrook wrote: post #80
matheusmoreira wrote: post #63

Earlier quoted context omitted.

> It should be noted that this app is temporary. Don't believe that for a second. Nothing is so permanent as a temporary government program.

The concept of an income tax was originally supposed to be temporary.

And passports too.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#95

Post by akoboldfrying »

matheusmoreira wrote: post #50
0x000xca0xfe wrote: post #39

Earlier quoted context omitted.

Then the solution could be just like the solution to tobacco addiction: tax social media companies HARD, tax all advertising on social media 10x, 20x, or ban advertising on/for social media outright, ban advertising of kids products, ban showing use of social media in movies not rated 18, ... the problem will vanish just like cigarettes. But no, that's not what governments are doing. They want control and surveillanc…

Taxing or banning advertising alone would fix literally everything that is wrong with the web.

Taxing may be a good way to restore balance. Banning means goodbye online news, Google Search, Gmail, YouTube, Maps, Translate, ad-supported games, etc. -- basically everything we've become accustomed to having for free will want a monthly subscription.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#96

Post by matheusmoreira »

dwattttt wrote: post #90
matheusmoreira wrote: post #57

Earlier quoted context omitted.

> If you want to actually enforce age restrictions I don't. This "think of the kids" nonsense is a psyop to manufacture consent for this shit. People really need to stop falling for it.

Do you also oppose drivers licensing, alcohol age limits? Those rely on a trusted ID managed by a government.

Not exactly a fan of those either, but they're much easier to tolerate because so far they aren't implementing a surveillance state straight out of a cyberpunk dystopia just to prevent kids from driving or drinking.

It's not like the car refuses to start if a dad tries to teach his kid how to drive.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#97

Post by throw-the-towel »

jmyeet wrote: post #43
xg15 wrote: post #25

Earlier quoted context omitted.

What you're saying is correct - but it's used to push a much more comprehensive lockdown of devices that has absolutely nothing to do with protection of minors. It's as if the government first let businesses install slot machines at every street corner, then suddenly went "I'm shocked, shocked! that we have a massive epidemic of gambling addiction here, we have to mandate anti-gambling shock collars for everyone to t…

This is the slippery slope fallacy and people in tech seem to love this argument. And you can argue in whichever direction you want with it. For example, "unfettered Internet access is just a series of tubes (shout out to Ted Stevens for that one) for pedophiles to rape your children." So now what? Is it your hyperbole against mine? The problem is that people are operating under a myth that they have anonymity. You d…

Maybe it's reasonable to argue a slope is slippery if you've just seen someone lubricate it.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#98

Post by lostmsu »

jryle70 wrote: post #78
matheusmoreira wrote: post #50

Earlier quoted context omitted.

Taxing or banning advertising alone would fix literally everything that is wrong with the web.

Do you know what happen when advertising is banned? It would go underground -- product placement, contest, merchandises, and so on. Advertising existed as soon as commerce became a thing, probably thousand years ago. It can't be banned. I wouldn't vote for that. Regulation, on the other hand, is fine. How? I don't know.

> It can't be banned

Sure it can. I don't see how being old makes it immune.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#99

Post by matheusmoreira »

izacus wrote: post #66
matheusmoreira wrote: post #53

Earlier quoted context omitted.

> Most analysts expect Total bullshit. There is no "effective" method without hardware remote attestation. If I control the system, I can just spoof whatever "verification" it is you're asking. The whole point of hardware attestation is to put a cryptographic key in the computer that the users can't ever get at, then use that key to prove the computer booted a corporate owned operating system that's 100% aligned with…

You can of course create an independent attestation database at any time and mandate its use - verifying that the custom OS you use fits minimum security requirements for digital ID use. We use that approach in several other industries. But.... that requires work beyond just complaining.

> You can of course create an independent attestation database at any time

Ah yes. They're totally going to trust my self-signed certificates. They're totally not going to restrict their trust set to the corporate owned and surveillance friendly Google and Apple devices.

Come on now.

> minimum security requirements for digital ID use

Also known as "the user has no control over the device".

Because users who have control can simply spoof this silly "digital ID" and there's nothing anyone can do about it.

> We use that approach in several other industries.

Your industries include the user of the device in their threat models. They want the device secured against the user. Absolutely unacceptable.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#100

Post by izacus »

matheusmoreira wrote: post #99
izacus wrote: post #66

Earlier quoted context omitted.

You can of course create an independent attestation database at any time and mandate its use - verifying that the custom OS you use fits minimum security requirements for digital ID use. We use that approach in several other industries. But.... that requires work beyond just complaining.

> You can of course create an independent attestation database at any time Ah yes. They're totally going to trust my self-signed certificates. They're totally not going to restrict their trust set to the corporate owned and surveillance friendly Google and Apple devices. Come on now. > minimum security requirements for digital ID use Also known as "the user has no control over the device". Because users who have cont…

> Ah yes. They're totally going to trust my self-signed certificates. They're totally not going to restrict their trust set to the corporate owned and surveillance friendly Google and Apple devices.

That sounds mostly like copium just to motivate your complete inaction.

Again - independent, EU based, attestation database is completely possible to make and we're using similar approval processes across multiple industries to certify hardware - locally, here in EU.

But yea, if you think you'll be able to print passport at home and then go travel and demand that government recognizes that as an ID document, you're a bit optimistic.

Post reply on HN