top 87 comments

sorted by: hot top controversial new old
[–] 146 points 1 year ago (19 children)

What's going on with Europe lately? You all really want GOOGLE of all mega corps in control of your identity?

You're going the opposite way, it should be your right to install an alternate OS on your phone. If anything they should be banning Google licensed Android.

  • source
  • hideshow 19 child comments
  • [–] 76 points 1 year ago (3 children)

    Its not the populace, our politicians just like in the US have gone rogue. People are voting for the nutters due to anti immigration propaganda and so increasingly getting far right. Its happening across the entire western world and its bad news for everyone.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 7 points 1 year ago*

    Except this isn't even the right wing nutters doing it. These are mainstream politicians executing their power grabbing neolib agenda, with very little democratic oversight or public debate.

  • source
  • parent
  • [–] [S] 35 points 1 year ago (7 children)

    I just wanted the EU to fork lineageOS and provide it as an alternative in major chains.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 12 points 1 year ago (5 children)

    I miss LineageOS so much, my last couple of phones haven't had a build of it and my asshole banking apps wont work on it now.

    For my next phone i'm just not going to buy one unless it's already supported and if I have to skip online banking I'll do it.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 6 points 1 year ago (3 children)

    one advantage of cards over banking apps

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 1 year ago (2 children)

    I use cards, I don't even have NFC on my phone, but it is nice to be able to check my bank account, lock/unlock the card, deposit checks, etc.

    I may be able to do most of that on the website, idk. Guess I'm probably going to find out :)

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago (3 children)

    to hear it from any non-Americans on lemmy they're better than America.

    looks like they're just as susceptible to this fascist bullshit to me though...

  • source
  • parent
  • hideshow 3 child comments
  • load more comments (1 reply)
  • [–] 82 points 1 year ago (7 children)

    Why is the EU licking america's asshole?

  • source
  • hideshow 7 child comments
  • [–] 38 points 1 year ago (6 children)

    'Cos it's been turning (far-)right as well in the last few years.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 24 points 1 year ago* (last edited 1 year ago) (5 children)

    Which is why Europeans shouldn't be too eager to laugh about the US being a fascist hellhole. It could happen there again if they're not vigilant.

  • source
  • parent
  • hideshow 5 child comments
  • [–] -2 points 1 year ago (2 children)

    No one is laughing... We're horrified how the people who have been screaming "freedom" and being obnoxious about how much more free they are than anyone else in the entire universe, seem to love getting enslaved while being obnoxious about how cool it is to be enslaved.

    Europe has its problems. We've had them for generations, and right now they're getting worse. But at least we have a culture of fighting back, something americans don't.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago

    In Hungary, we still have people who think fascism is when "evil people do evil things for the sake of evil", so when fascists want to hurt Roma, LGBTQIA+, etc. people, no one dares to call them fascists as long as said people have "receipts" in the form of cobbled together statistics, and have a not too cruel solution.

  • source
  • parent
  • [–] 5 points 1 year ago

    But at least we have a culture of fighting back, something americans don’t.

    Talk is cheap. Prove it in the coming years. I really hope you're right, because I want SOMEWHERE to not be either a coporate fascist hellholle or a collapsed country in the future..

  • source
  • parent
  • [–] 81 points 1 year ago (1 child)
  • [–] 220 points 1 year ago* (last edited 1 year ago) (29 children)

    Please don't link to Reddit. Context below:

    The EU is currently developing a whitelabel app to perform privacy-preserving (at least in theory) age verification to be adopted and personalized in the coming months by member states. The app is open source and available here: https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui.

    Problem is, the app is planning to include remote attestation feature to verify the integrity of the app: https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui?tab=readme-ov-file#disclaimer. This is supposed to provide assurance to the age verification service that the app being used is authentic and running on a genuine operating system. Genuine in the case of Android means:

    • The operating system was licensed by Google

    • The app was downloaded from the Play Store (thus requiring a Google account)

    • Device security checks have passed

    While there is value to verify device security, this strongly ties the app to many Google properties and services, because those checks won't pass on an aftermarket Android OS, even those which increase security significantly like GrapheneOS, because the app plans to use Google "Play Integrity", which only allows Google licensed systems instead of the standard Android attestation feature to verify systems.

    This also means that even though you can compile the app, you won't be able to use it, because it won't come from the Play Store and thus the age verification service will reject it.

    The issue has been raised here https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/issues/10 but no response from team members as of now.

  • source
  • hideshow 29 child comments
  • [–] 49 points 1 year ago (23 children)

    So is there a way to apply pressure on the EU to think this through first? Surely they could have different ways that doesn't lock them in to google services.

  • source
  • parent
  • hideshow 23 child comments
  • [–] 45 points 1 year ago (1 child)

    According to the users in that issue, the mere application of the API is illegal, as is the dependency. Sooo I dunno what kind of PACs there are in the EU but I would be leaning on and contributing to those.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 14 points 1 year ago

    I do feel like that’s a precarious state to leave this in, especially if they’re developing the backend for it.

    Is there even enough momentum for a SKG-style wave of coverage? It would need to be justified properly by citing things like the Tea app data leak, to make a strong case (to political pencil pushers) for the danger of tying personal information to profiles or even to platforms. Otherwise the only thing they’ll see is “gamers want to make porn accessible to children”.

    I don’t know. This whole situation boils my blood because I really care about online anonymity, and this is kind of nightmare scenario shit for me. I’m not even in the UK or EU.

  • source
  • parent
  • [–] 10 points 1 year ago* (last edited 1 year ago) (20 children)

    To avoid people from simply copying the "age proof" and having others reuse it, a nonce/private key combo is needed. To protect that key a DRM style locked down device is necessary. Conveniently removing your ability to know what your device is doing, just a "trust us".

    Seeing the EU doesn't make any popular hardware, their plan will always rely on either Asian or US manufacturers implementing the black-box "safety" chip.

  • source
  • parent
  • hideshow 20 child comments
  • [–] 1 point 1 year ago (15 children)

    The key doesn't have to be on your phone. You can just send it to some service to sign it, identifying yourself to that service in whatever way.

  • source
  • parent
  • hideshow 15 child comments
  • [–] 1 point 1 year ago* (14 children)

    It's that "whatever way" that is difficult. This proposal merely shifts the problem: now the login to that 3rd party can be shared, and age verification subverted.

  • source
  • parent
  • hideshow 14 child comments
  • [–] 2 points 1 year ago (13 children)

    A phone can also be shared. If it happens at scale, it will be flagged pretty quickly. It's not a real problem.

    The only real problem is the very intention of such laws.

  • source
  • parent
  • hideshow 13 child comments
  • [–] 1 point 1 year ago (12 children)

    If it happens at scale, it will be flagged pretty quickly.

    How? In a correct implementation, the 3rd parties only receive proof-of-age, no identity. How will re-use and sharing be detected?

  • source
  • parent
  • hideshow 12 child comments
  • [–] 1 point 1 year ago (11 children)

    There are 3 parties:

    1. the user
    2. the age-gated site
    3. the age verification service

    The site (2) sends the request to the user (1), who passes it on to the service (3) where it is signed and returned the same way. The request comes with a nonce and a time stamp, making reuse difficult. An unusual volume of requests from a single user will be detected by the service.

  • source
  • parent
  • hideshow 11 child comments
  • [–] 1 point 1 year ago* (10 children)

    from a single user

    Neither 2 nor 3 should receive information about the identity of the user, making it difficult to count the volume of requests by user?

  • source
  • parent
  • hideshow 10 child comments
  • [–] 1 point 1 year ago (9 children)

    Strictly speaking, neither needs to know the actual identity. However, the point is that both are supposed to receive information about the user's age. I'm not really sure what your point is.

  • source
  • parent
  • hideshow 9 child comments
  • [–] 1 point 1 year ago (8 children)

    I must not be explaining myself well.

    both are supposed to receive information about the user's age

    Yes, that's the point. They should be receiving information about age, and age only. Therefore they lack the information to detect reuse.

    If they are able to detect reuse, they receive more (and personal identifying) information. Which shouldn't be the case.

    The only known way to include a nonce, without releasing identifying information to the 3rd parties, is using a DRM like chip. This results in the sovereignty and trust issues I referred to earlier.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 1 point 1 year ago (7 children)

    The site would only know that the user's age is being vouched for by some government-approved service. It would not be able to use this to track the user across different devices/IPs, and so on.

    The service would only know that the user is requesting that their age be vouched for. It would not know for what. Of course, they would have to know your age somehow. EG they could be selling access in shops, like alcohol is sold in shops. The shop checks the ID. The service then only knows that you have login credentials bought in some shop. Presumably these credentials would not remain valid for long.

    They could use any other scheme, as well. Maybe you do have to upload an ID, but they have to delete it immediately afterward. And because the service has to be in the EU, government-certified with regular inspections, that's safe enough.

    In any case, the user would have to have access to some sort of account on the service. Activity related to that account would be tracked.


    If that is not good enough, then your worries are not about data protection. My worries are not. I reject this for different reasons.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 1 point 1 year ago* (last edited 1 year ago) (6 children)

    is being vouched for by some government-approved service.

    The reverse is also a necessity: the government approved service should not be allowed to know who and for what a proof of age is requested.

    And because the service has to be in the EU, government-certified with regular inspections, that's safe enough

    Of course not: both intentional and unintentional leaking of this information already happens, regularly. That information should simply not be captured, at all!

    Additionally, what happens to, for example, the people in Hungary(*)? If the middle man government service knows when and who is requesting proof-of-age, it's easy to de-anonymise for example users of gay porn sites.

    The 3rd party solution, as you present it, sounds terribly dangerous!

    (*) Hungary as a contemporary example of a near despot leader, but more will pop up in EU over the coming years.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 1 point 1 year ago (5 children)

    The reverse is also a necessity: the government approved service should not be allowed to know who and for what a proof of age is requested.

    It would send the proof to you. It would not know what you do with it. I gave an example in the previous post how the identity of the user could be hidden from the service.

    If the middle man government service knows when and who is requesting proof-of-age, it’s easy to de-anonymise for example users of gay porn sites.

    It would be a lot easier to get that information from the ISP.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 1 year ago (4 children)

    I gave an example in the previous post how the identity of the user could be hidden from the service.

    In both your examples the government service has your full identity, then pinky promises to forget it.

    Unless I'm misunderstanding something?

    It would be a lot easier to get that information from the ISP.

    Not quite the same, as IP addresses are shared through NAT, VPNs exist, etc. With the proposed legislation it is illegal for website operators to deliver content to known VPN ips, as they cannot confirm that the end user isn't a EU subject.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 1 year ago (3 children)

    In both your examples the government service has your full identity, then pinky promises to forget it.

    It can be like buying alcohol in a store. They look at you and see your age. Or if it's unclear, the store clerk asks your idea and promptly forgets all about it. Except you're not buying alcohol but a login for some age verifier.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 year ago* (last edited 1 year ago) (2 children)

    So yes, they get your identity, then promise to forget it.

    That's a worst of both worlds proposal: it makes it trivial to deanonymise people, and it doesn't solve the replay attacks.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 year ago (3 children)

    If it is about hiding some data handled by the app, that will be instantly extracted.
    There are plenty of people with full integrity on rooted phones. It's really annoying to set up and keep going, and requiring that would fuck over most rooted phone/custom os users, but someone to fully inspect and leak everything about the app will always be popping up.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 year ago (2 children)

    If it is about hiding some data handled by the app, that will be instantly extracted.

    Look at the design of DRM chips. They bake the key into hardware. Some keys have been leaked, I think playstation 2 is an example, but typically by a source inside the company.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago (1 child)

    That applies to play integrity, and a lot of getting that working is juggling various signatures and keys.
    The suggestion above which I replied to was instead about software-managed keys, something handed to the app which it then stores, where the google drm is polled to get that sacred piece of data. Since this is present in the software, it can be plainly read by the user on rooted devices, which hardware-based keys cannot.

    Play integrity is hardware based, but the eu app is software based, merely polling googles hardware based stuff somewhere in the process.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago

    merely polling googles hardware based stuff

    I understand. In the context of digital sovereignty, even if the linked shitty implementation is discarded (as it should be), every correct implementation will require magic DRM-like chip. This chip will be made by a US or Asian manufacturer, as the EU has no manufacturing.

  • source
  • parent
  • [–] 2 points 1 year ago (4 children)

    Wouldnt it be enough to verify through IMEI to make sure the OS isnt emulated?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 6 points 1 year ago (3 children)
  • [–] 1 point 1 year ago (2 children)

    Is it tied to my real identity?
    If not it seems to me that it should be sufficient as to serve as a security this phone is legit and not emulated/compromised.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago

    In the eu, phone numbers by law are tied to state identities.
    And the phone provider can naturally resolve their sim IDs down to the phone number they are assigned to.
    Anything related to celltower interactions is PII.

  • source
  • parent
  • [–] 137 points 1 year ago (6 children)

    Fuck the play integrity API, Play Store and Google play services

  • source
  • hideshow 6 child comments
  • [–] 27 points 1 year ago (5 children)

    And the EU for their stupid fucking censorship

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 1 year ago (4 children)

    Sure, but it has some good sides as well

    It's just a shame that they aren't just made of the good sides

  • source
  • parent
  • hideshow 4 child comments
  • [–] 2 points 1 year ago (3 children)

    Excuse me, censorship is not good in any way. The people should have the power to decide what they want to see, and what they want to say. Not government officials nor private platform owners.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 1 year ago (2 children)

    I was saying the EU has done some great things, not that censorship has good sides

  • source
  • parent
  • hideshow 2 child comments
  • [–] 60 points 1 year ago (2 children)

    The US might have shot itself in the foot by electing Trump, but the EU is really going to shoot itself in the head if that continue in the same trajectory.

  • source
  • hideshow 2 child comments
  • [+] -11 points 1 year ago (2 children)
  • load more comments (-1 replies)
    [–] 54 points 1 year ago (3 children)

    So VPN on the router permanently set to Singapore it is.

  • source
  • hideshow 3 child comments
  • [–] 10 points 1 year ago (2 children)

    Apparently this is illegal to implement as of right now, but it’s not helping the feeling of technological doomerism I get whenever I think about this whole identity verification situation.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 1 year ago (1 child)

    Sorry, do you have any sources for this? I was just thinking about getting a VPS in Switzerland today.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago

    Some other commenter mentioned that this is brought up in issues tracker in the repo. Sorry, I didn’t actually check for it.

    I’m not in the EU, I didn’t dig into it. FWIW I am also moving my own connections to exit from Switzerland sooner or later.

  • source
  • parent
  • [–] 105 points 1 year ago* (8 children)

    Yeah no. Requiring anything Google for something as basic as this violates the GDPR. If they go through with this, it's one legal case until they have to revise it.

    Edit: German eID works on any Android btw., flawless actually. I sure hope I can use that for verification

  • source
  • hideshow 8 child comments
  • [–] 20 points 1 year ago

    Edit: German eID works on any Android btw., flawless actually. I sure hope I can use that for verification

    Same in Italy... I mean, I can pay taxes with that application but I cannot be verified for my age ? Seriously EU ?

  • source
  • parent
  • [–] 14 points 1 year ago (3 children)

    EID and equivalents are great for a lot of things, but do you want your porn site to know who you are? The new app is supposed to verify your age but not give out your PII. Not sure eID can do that?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 22 points 1 year ago (2 children)

    EID can be used for anonymous age verification. It doesn't even need to give out your birthday and can attest to any "over the age of X" requirement.

    Ref: https://www.bfdi.bund.de/DE/Buerger/Inhalte/Telematik-Statistik-Verkehr-Bildung/Meldewesen-Statistik/Der_Personalausweis.html

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 1 year ago (2 children)

    violates the GDPR.

    I wouldn't be too sure. Data protection mainly binds private actors. Any data processing demanded by law is legal. You'd really have to know the finer points of the law to judge if this is ok.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago (1 child)

    The GDPR also applies to public institutions as far as I'm aware - but most importantly the concern here is Google and data collected by Google. This data collection is in no way necessary to provide the age verification service. Most of it is not even related to it. The state legally cannot force you to agree to some corporations (i.e. Google's) terms, even if we completely ignore the GDPR.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago

    Data processing mandated by law is legal. Governments can pass laws, unlike private actors. Public institutions are bound by GDPR, but can also rely on provisions that give them greater leeway.

    I don't see how that this is in any way necessary, either. But a judge may be convinced by the claim that this is industry standard best practice to keep the app safe. In any case, there may be some finer points to the law.

    The state legally cannot force you to agree to some corporations (i.e. Google’s) terms,

    I'm not too sure about that, either. For example, when you are out of work, the state will cause you trouble if you do not find offered jobs acceptable.

    It's another question, if not having access to age-gated content is so bad as to force you to do anything. Minors nominally have the same rights as full citizens, and they are to be denied access, too.

  • source
  • parent
  • [–] 46 points 1 year ago (3 children)

    so if I use graphene os then I can't look at porn in the eu

  • source
  • hideshow 3 child comments
  • [–] 19 points 1 year ago (2 children)
  • load more comments
    view more: next ›