Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EU Age Verification Project Mandates Hardware-Bound Attestation

linuxiac.com

Post reply on HN
Print view View original

121–130 of 206 posts

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#121

Post by SoftTalker »

jolmg wrote: post #107
SoftTalker wrote: post #76

Earlier quoted context omitted.

"Boobies" really understates what is available virtually unrestricted on Pornhub and similar sites. If "boobies" were the extent of it, far fewer people would be worried about it.

On restricting, I really think that's the responsibility of parents. I think the problem here is that Android and iOS don't empower their users (parents) to implement proper parental controls. I imagine apps don't get the access and maybe the parental controls implemented by the OS don't suffice? Maybe because Android and iOS benefit from these kinds of legislation that cement their duopoly.

I agree that none of the current user platforms, i.e. Android, iOS, nor desktop, have adequate parental controls that are easy to use. Parental controls are important but that's not enough. We expect parents to not buy liquor for their kids, and make reasonable efforts to prevent their kids from obtaining it. But we also expect liquor stores to not sell liquor to kids. We should likewise expect that internet content platforms do not deliver inappropriate content to kids.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#122

Post by CamperBob2 »

AuthAuth wrote: post #116
big85 wrote: post #18

All this ostensibly to keep teenage boys from watching Pornhub (when parental controls already exist). The real reason, of course, is to force people to connect strong real-life identifiers to online activity. Mobile first, then Windows. Then Linux is too weak to oppose on its own, and will adapt or die.

There should be real life identifiers connecting to online activity. Why should online actions be untraceable? That only empowers bad actors.

I don't see your real name on your user page, unless your parents named you AuthAuth.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#123

Post by izacus »

matheusmoreira wrote: post #113
izacus wrote: post #111

Earlier quoted context omitted.

> Why not tell us more about the requirements for hardware certification? Err, it's actually pretty simple: the token/certificate representing your ID (or credit card, or anything really) cannot be exfiltrated by userspace or installed kernel space apps or intercepted on the way to TPM when issued. And it cannot be duplicated. It's the same set of requirements that are put on credit card smart chips and biometric chi…

> cannot be exfiltrated by userspace or installed kernel space apps or intercepted on the way to TPM So it must be secure against the user, as expected. Preventing the user from "tampering" with the token means carving out a section of the machine and putting it out of his reach. You just created a government embassy on the user's machine. There's no telling what it will be abused for, and there's no escape. > But su…

Yes, that's what a TPM or smart card chip in your ID/Passport does.

Prevents tampering even by the "user".

I have advocated nothing of the sort you're accusing me of. Please leave your strawman at home.

Having a physical card fallback here is a necessity and nothing in these proposals shows that the physical card ID is going away.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#124

Post by wbl »

tzs wrote: post #60

It should be noted that this app is temporary. The EU is aiming for a digital wallet app that you can store your identity documents in and that you can use to prove facts about those documents to third parties, in a way where the third party gets no extra information--just what you chose to disclose (e.g., just your age or just your country) and that cannot be used to link your real identity to your using the site ev…

The hardware security module does not need to change to support tying to a credentials. I showed how to do this years ago and the theory was known long before. Its just that the EU is making self imposed barriers to doing this right.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#125

Post by userbinator »

izacus wrote: post #54
userbinator wrote: post #14

I expect a gray/black market in TPM keys and the like will grow if this takes off, but hopefully the citizens will fight it very strongly before then... ...but then again, this is the EU, not the US.

Hardware attestation literally prevents that. That's why it's mandated.

More precisely tries to prevent, but there have been occasional articles about breaking TPMs here; and I suspect once they become a major obvious barrier to freedom, we're going to see a lot more attacks on them, and more successful ones too.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#126

Post by pibaker »

dgroshev wrote: post #69
jolmg wrote: post #61

Earlier quoted context omitted.

> The surveillance is implicit and hidden. If we understand that it’s nearly impossible for a non-tech person to avoid being tracked by corporations and governments, then we start working on the things that really help: super tight regulations about what can and can’t be tracked. We can't get perfect privacy so we should normalize not having any? Leave it to the government we're distrusting to handle our privacy? > I…

Just a few decades years ago, everyone's names and phones in the US were freely available to anyone with a phone book. Communications were done in the clear, either via letters (hardly tamper-proof), or via phone (that anyone with access could tap). Did every American live in a "surveillance state" back then?

Bad analogy. A phone book tells you nothing about who you are talking to or what you are talking about over the phone. Most free countries don't let law enforcement read letters without a warrant. And even in authoritarian states the police couldn't wiretap everyone or read every letter. The volume was simply too massive for any manual operation.

Digitalization and now AI technology changes this drastically because it makes it drastically cheaper to record and flag human communications.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#127

Post by bulbar »

AuthAuth wrote: post #116
big85 wrote: post #18

All this ostensibly to keep teenage boys from watching Pornhub (when parental controls already exist). The real reason, of course, is to force people to connect strong real-life identifiers to online activity. Mobile first, then Windows. Then Linux is too weak to oppose on its own, and will adapt or die.

There should be real life identifiers connecting to online activity. Why should online actions be untraceable? That only empowers bad actors.

Bad actors will stay untraceable.

What specific generalized problem would you like to be solved that you advocate for such a generalized solution?

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#128

Post by fyredge »

dgroshev wrote: post #106
jolmg wrote: post #102

Earlier quoted context omitted.

> You just said it yourself: the perceived danger of overreach was averted through new laws and control over what the government is doing. If citizens still have a capacity to restrict the government via (enforced) laws Restricting the government via laws... The government implements the laws. Trying to restrict the government via laws is mostly just asking "pretty-please don't screw us over." They're not going to ma…

Indeed, Trump is a great example of democratic backsliding completely unfettered by "freedoms" often mistaken for the actual freedom. The way forward is being able to change things or regaining this ability if it's lost, not trying to carve out some bit that's not under the government's control yet. That's just a form of escapism.

There is a malaise permeating modern culture, where social action does not enter the mind at all, possibly because it does not provide instant results. Collective action and organising local communities has always been the solution to social ills. It's why I'm looking forward to the progressives in US, they seem to be organising themselves quite well.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#129

Post by kilburn »

jimmygrapes wrote: post #104
lostmsu wrote: post #98

Earlier quoted context omitted.

> It can't be banned Sure it can. I don't see how being old makes it immune.

It'd be tough to phrase it right. Imagine that The Ones Who Ban Things decide to write something interpretable as essentially "nobody is allowed to inform others about things". The process of distilling any ad banning law into applicable testing of that law would be pretty scary to me

Other legistlation plays a similar game:

- Slandering laws set a limit for what you can say about others

- Copyright laws set a limit on what you can share with others under which circumstances

Both those things seem similarly complicated to implement and yet we have them.

Re: EU Age Verification Project Mandates Hardware-Bound Attestation

#130

Post by tavavex »

phendrenad2 wrote: post #85

The downvoted comments here are very interesting, and it really shows a divide in beliefs here. I fear that there's no reconciling this, and in the end we'll need two internets: The EUternet and the USternet.

The US is moving in the same general direction, even if they take slightly different measures. The universal tracking of everyone is something all these governments can suddenly agree on.

If after this is enacted the firewalls aren't perfect, the internet will probably instead splinter into the Westernet and the everywhere-else-net for the rest of the countries that are too disorganized or uncaring to join in on the fun, maybe with a few safe havens of something resembling the old web in between.

Post reply on HN