11–20 of 33 posts
There's one thing "the hackers" haven't considered, though! It's illegal to hack an app in the EU, so the problem of bypassing age verification by hacking saved files doesn't arise at all! /s
That's not the real age verification app (there is no "EU app", every member state releases their own), it's the proof of concept that was made to demonstrate the system. This stuff is also why the EU doesn't want the app to run on rooted devices. I don't believe there's a way to pass Strong Integrity yet, as the app doesn't support the hackable Android 8 software attestation.
I just want this whole idea to kindly please bog off. We shouldn't be further creating the apparatus of the surveillance state.
That's not the real age verification app (there is no "EU app", every member state releases their own), it's the proof of concept that was made to demonstrate the system. This stuff is also why the EU doesn't want the app to run on rooted devices. I don't believe there's a way to pass Strong Integrity yet, as the app doesn't support the hackable Android 8 software attestation.
That's not the real age verification app (there is no "EU app", every member state releases their own), it's the proof of concept that was made to demonstrate the system. This stuff is also why the EU doesn't want the app to run on rooted devices. I don't believe there's a way to pass Strong Integrity yet, as the app doesn't support the hackable Android 8 software attestation.
If the app wants to take advantage of mandatory hardware attestation, it has to require Android 13 or later. This would undermine somewhat the promise that the app supports a wide range of devices. Even banks don't currently enforce Android 13+.
Although, hardware attestation should be available for Android 8+. Only older Android versions can be spoofed.
You can still get strong integrity, but [as the docs state](https://developer.android.com/google/play/integrity/verdicts):
> On Android 12 and lower, the MEETS_STRONG_INTEGRITY verdict only requires hardware-backed proof of boot integrity and does not require the device to have a recent security update. Therefore, when using the MEETS_STRONG_INTEGRITY, it is recommended to also take into account the Android SDK version in the deviceAttributes field.
That's not the real age verification app (there is no "EU app", every member state releases their own), it's the proof of concept that was made to demonstrate the system. This stuff is also why the EU doesn't want the app to run on rooted devices. I don't believe there's a way to pass Strong Integrity yet, as the app doesn't support the hackable Android 8 software attestation.
> This stuff is also why the EU doesn't want the app to run on rooted devices. I would argue the EU doesn't want to run it on rooted devices because malware could violate the security sandbox and intercept information. This is largely the same reason why Google Pay requires SafetyNet.
That's not the real age verification app (there is no "EU app", every member state releases their own), it's the proof of concept that was made to demonstrate the system. This stuff is also why the EU doesn't want the app to run on rooted devices. I don't believe there's a way to pass Strong Integrity yet, as the app doesn't support the hackable Android 8 software attestation.
I just want this whole idea to kindly please bog off. We shouldn't be further creating the apparatus of the surveillance state.
There's one thing "the hackers" haven't considered, though! It's illegal to hack an app in the EU, so the problem of bypassing age verification by hacking saved files doesn't arise at all! /s
I assume it's also illegal as someone underage to access all the things protected by the age verification app. So we don't need the app then :-)
Earlier quoted context omitted.
I just want this whole idea to kindly please bog off. We shouldn't be further creating the apparatus of the surveillance state.
My understanding is that this is much more privacy friendly than showing your id
Earlier quoted context omitted.
I just want this whole idea to kindly please bog off. We shouldn't be further creating the apparatus of the surveillance state.
Yeah I don’t like how the discussion is shifting to implementation details, instead of debating whether any of this is good or necessary
Why/how would this be a bad thing?
That's not the real age verification app (there is no "EU app", every member state releases their own), it's the proof of concept that was made to demonstrate the system. This stuff is also why the EU doesn't want the app to run on rooted devices. I don't believe there's a way to pass Strong Integrity yet, as the app doesn't support the hackable Android 8 software attestation.
Where does the EU say so?