"zero talk about forcing companies (at least for the ones shipping android phones) to open up their firmwares and allow users to install alternative OS if they want to sell in the EU."

Complete public datasheets on how to program the hardware should be a requirement fit a DMA2.0.

This is not entirely true. I don't have much details but I know people who started to work on two separate free software projects aiming to make supported mobile OS. These projects couldn't get funding before but they do now. Afaik it's still a battle with AI companies lobbying that soverign AI is much more important than mobile OS but there is some growing interest. Imho i don't even think some linux based alternative to Android would be that hard to pull off but it's the hw companies that will be skeptical to build hw for such OS. I would have to be some govs puahing it as secure gov devices first.

They could try and put money into funding Jolla/sailfish/whatever

Because this is all a political move. This so-called "EU sovereignty" drive is in fact aimed at further reducing sovereignty of the member states via further transfer of power and control to the EU.

These digital ID wallets do exactly that. Member states lose control of the ID infrastructure, which will now be controlled by the EU. There isn't much sovereignty left at national level...

"This is the elephant in the room regarding the big "digital sovereignty" talks in the EU"

The elephant in the room is that it is just talk, as always in case of EU.

Yes, spot on, the talk is always around Office and co.

The sovereignty thing is a theater. Many french unis use Google cloud because they're broke and can't maintain in-house services, and none gives a damn.

Isn't AOSP a thing?

Mobile is the UI/UX equivalent of… I don’t even know… a moon landing? A wonder of the world?

I’m not saying it can’t be duplicated. I’m saying if you want to build a mobile platform you need to approach it with appropriate respect for the incredible difficulty of making something that usable.

Ok we get new HN articles every week now about migrating to EU solutions and digital sovereignty. At this point EU should just do as China, please: have EU their own cloud providers, softwares, hardwares, phones and also its own closed-EU only mini-internet barrier by a big EU digital policy border. Just like China, NKorea and Russia. They would be finally at peace with themselves.

But it is needed to protect the children. The politicians say so, so it has to be true. Being against this is very dangerous to our children and democracy. There is no alternative.

Seriously, there is something tremendously wrong with governance when politicians keep changing the whole world around us, without us having any say in it at all. The threat this measure poses to the internet and society is significant, yet it is being pushed through without any substantial debate or push back. This just is not how decent and actual democracies should function. What messed up timeline is this?

There’s a huge amount of stuff that the EU does that no one consented to, or had a realistic democratic avenue to influence.

I’m in the UK and very anti Brexit. But were we still in, I would have no idea how to influence what happens behind those closed doors at the European Commision.

Granted the current UK Labour/ Conservative pact on these issues show they’re completely out of control. But I still theoretically know how I could influence policy.

I and many others have been banned from Twitter for the last two weeks because of a new process[1]. I have to view all links in incognito tabs or hand over my biometric data to a trillionaire. Just don't use Twitter some may quip, well that would be a great group effort, but I can't do it alone.

[1] https://old.reddit.com/r/Twitter/comments/1uk6a98/lets_confi...

> The question is why they're pushing it onto everyone. I did not consent to this, neither did you.

The representatives elected by Europeans did though: 483 votes in favor, 92 against

I know this sounds bad, but when has consent mattered before? I agree with you wholeheartedly, but consent is simply not something these power structures value.

Some people consent to it, and they have a voice too. If they win and you didn't also consider the technical solution, you will find yourself not only with a law you disagree with, but also with a terrible technical solution.

So whatever you opinion is on the subject of forcing age verification, it is worth looking at the technical solution, especially if it is your domain of expertise.

The halls of power are full of pedophiles. Why do you think they want to gather data on children?

Yes, I said it before and I will say it again: We should invest our energy in the discussion whether to implement it and not already wonder how to implement it.

Shifting this question benefits only those who want to force this upon us.

They want to protect the children so that they can take them to the island

'They' are not pushing age verification onto everyone. 'We' are pushing it onto ourselves. People want this. It is popular all over the world. If 'they' are doing anything, it is subverting what people want into something else. Which is the worry here, as people asked for age verification but didn't ask to be locked into the mobile phone duopoly. The system people want for age verification could be implemented as Firefox plugin. If it requires these attestation services for binary blobs provided by the government, it includes features someone else wants.

Government issued versus corporate issued age verification is a false dichotomy. There are other options, such as refusing games that require them. (Yes, we do have a teen, and yes we did exactly that with Roblox.)

As a purely tactical measure, we use the same older person (me) for age verification for all family members - zero failures so far and it poisons the well.

You can (and should) be mad at the government and at Roblox at the same time.

Also, don't use Roblox, you can freely share games made with PICO-8, Löve, Godot, Rpgmaker, Game maker and the like, no need to go to the hell scape that is Roblox and its dark patern and locked down ecosystem.

I hear you on the overall privacy issues related to age verification with US Corps. My concern with government registries of personal information is related to things like:

- Netherlands, WWII: The Dutch civil registry meticulously recorded religion. It’s a major reason ~75% of Dutch Jews were killed, the highest rate in occupied Western Europe (vs ~25% in France, where records were poorer).

- US, Japanese internment: The Census Bureau provided block-level data on Japanese Americans in 1942 despite confidentiality guarantees; 2007 research showed individual names and addresses were shared too.

- Rwanda, 1994: Belgian colonial administrators had put ethnicity (Hutu/Tutsi) on national ID cards in the 1930s. Sixty years later those cards were the primary tool at genocide checkpoints.

There’s loads more. Europe may be safe now so it feels safe to give government this information. However, as shown in all the instances above, the information was collected for one reason and used for a wholly different reason when times changed.

Who knows what kinds of ethnicities, beliefs, behaviors or personal histories will be the focus of future regimes? It could be Roblox users, HN commenters, people who religiously repost x.com links as xcancel.com ones, anything. Whatever it is, they will have access to all the data on any system we allow them to record. This isn’t even a totally made up hypothetical from far away places, multiple governments in Europe were doing this kind of thing just decades ago. Historically speaking, we are all currently living in an unusually peaceful era, that will likely be temporary for many of us.

I guess that is one way to manufacture consent.

The original design intention of this approach was that wallet apps were independant and interchangable, with any wallet app able to talk to any attestation provider, to get age attestation tokens, and any site/app able to talk to any wallet. The wallet's job was merely to securely hold a bunch of attestations tokens, and dispense them to other sites/apps on request.

So you could use an open source app, or government provided one, or one provided by your bank, whatever you trust the most to not be recording data about relying parties and sending it somewhere you don't want.

The version of the document currently on GitHub has heavily deviated from that original intention. This is very unfortunate.

Even so this version is supposed to still be incapable by design of sharing any data with a relying party other than "over 18" and was designed such that the only way for a relying party to determine your identity is to be colluding with the attestation provider, or by colluding with the wallet app.

To attempt to address the first issue they have the unfortunately optional ZKP protocol. The original design assumed that users could find a wallet that they were certain would not collude with the RPs, and was considered a non-issue, but unfortunately it is a huge hole in the current version.

Same as for banks. Downloading some verification app with a confidence inspiring 1.2 rating on the app store, getting on a call with some random gig worker looking like they are taking the call in their living room and wiggling your ID around while giving a thumbs up is not the way I would like to prove my identity to a bank.

But there's no alternative. The EU digital identity wallet would be the alternative. You control and exactly see, what kind of information the bank is getting from you and you can be sure that it doesn't flow through some sketchy third-party identification service.

It doesn't have to be an either or dichotomy. For example, you could pass laws that make it illegal for an online game to demand age verification, identification, biometrics, etc. The main reason for any of this are some corporate attorneys justifying their own salaries based on "what if" and scaremongering. Regardless of how much personal information they succeed at demanding at this stage, or how [in]effective it is at addressing their claimed problems, they will be back again pushing for even more until they're actually told a hard "no".

Here in the Baltics we already have an app for that. It's used to login to banks and government websites.

Recently one supermarket chain added it for age verification on their self-service checkouts (e.g. buying alcohol).

The problem with this is you do not know what information they get, I guess the supermarket gets my full name, date of birth, personal code, etc. Their privacy policy says it will not be stored, but that means nothing.

https://www.smart-id.com/

> Roblox made a change where you’re not allowed to share your games with friends unless you do “age verification”

My son had a similar "making games" interests and I just showed him the Godot engine. Roblox bosses are doing you a favor. Act now :D

> a government supplied app, that’s guaranteed to protect my privacy

This is a bit of a 64,000 euro question, though. Look very closely at what the government exemptions for GDPR are.

> this means sharing your 3D likeness with some sketchy American business who pinky promises to delete said data after. I don’t want random American tech companies to have my kids’ biometric info like that, able to sell it to whoever asks. Nor my passport or anything like that.

Actually the market leader app for scanning faces and documents is an Israeli company. They encourage to use mobile for scanning, for your convenience. They promise they delete the data. Yeah, if they're lying you can sue them in Israel.

What you’re proposing works only if the government is always trustworthy and abiding by the rules. But there has been cases that ICE agents in US was able to track down people from their social media posts and in the past Nazis used the address registration lists to track down Jews for deportation to concentration camps.

We don’t know what EU would become in 5 to 10 years in the future, and I would rather not have any identification information about me or family being stored by a government body or any other party that can track/link me or my family members

> a government supplied app, that’s guaranteed to protect my privacy

[citation needed]

Funny you use Netherlands as a good example, considering that famously, their existing unusually thorough registry was super helpful for the Nazis rounding up jews later.

I don't think it's Godwin's Law when you are so spot on, exactly describing the worst case.

[flagged]

Then get your kid off Roblox. I promise you that Roblox exploits more children in a single day than all sex offenders put together do in a year.

Why is pedophilia such a problem on Roblox? It's because they heavily advertise towards children and one of the fastest ways for children to make money is asking their parents, then next is prostitution. Roblox is uniquely bad because they heavily advertise both products and the "self-made entrepreneur" image to children.

Putting the blame on nebulous "predators" when the system itself is clearly to blame is the very tacit Roblox relies on. Look at vehicular manslaughter are drunk and distracted drivers solely to blame for deaths? Clearly not since there are just as many drunks and phones in Europe as in the US. When the system creates more predators than exist otherwise then you know it needs to change.

If your son likes making games keep him on Godot. Your job as a parent is to find or build a good distribution system. you can see if he is generally interested or if he was pressured by an exploitative system grooming him into pumping out slop for the trough. Age verification is going to make the platform more exploitative in the business sense. Both in that it legitimizes bad practices and lets Roblox target their exploitative practices more effectively.

It's isreali as well: https://www.404media.co/id-verification-service-for-tiktok-u...

The "app" could be a good solution, if it didn't require attested Android or iOS. It could, for example, have me plug my ID chip into my GNU/Linux system and expose it with a standard protocol. That would be no problem. The problem is that they do not want such a way.

In any case, I think that age gating would not be needed if the platforms were regulated to remove addictive recommendation algorithms.

We have had the need to prove age for hundreds of years. To buy alcohol. To drive a car. To vote. We depend on government-issued documents to do this. Not sure why anyone would really expect this to change just because it's online now.

A certified Real Opinion (tm). The only thing missing is the checkmark.

This is only an issue if it's the only way of verifying your age. If it's still accessible to everyone and this makes it significantly easier for 99.9999999% of people then why not?

And the youths who just... don't like smartphones. We exist

Don't worry the focus is on the youth with this legislation. I have the suspicion it's about indoctrination of surveillance as normal.

Additionally the amount of elderly that don't have or can't use a phone or don't have anyone that can help them with it will decrease rapidly anyway. In my experience it's mostly the same generation as the people that remember WWII.

They probably think that they do not use "social media" either, so it does not affect them. But elders are not the only category. In any case, it is fundamentally wrong to be forced to use a specific platform, American or European, mobile or desktop, for Internet service access.

That's because they are lying to the people here. Just look at the "we must protect the children" lobbyists. It has never been about the children in the first place, that is just the convenient lie to force an authoritarian system in place.

I don't think this is relevant for them by definition, so that's an odd point to raise. It's hard to be encumbered by having to manage a digital identity, when you don't do anything digitally in the first place.

I will try my best, but at some point I feel this won't help. 98% of people have no problem with this. In fact they probably even see this as a positive, finally they don't have to identify via these shitty video services from various call centers anymore, and even the children are perfectly safe now.

I am quite pessimistic. They couldn't care less about some 2% of people who just stop using their services.

Buffoon (not bafoon).

You won't be able to see a doctor when you're sick.

You won't be able to open a bank account to receive your salary.

You won't be able to buy train or plane tickets.

My point is I am most worried that these kind of "digital verification" type things most impact actual necessities. The social media I couldn't care less about. "I just won't use it" isn't really a solution.

Well, they could change the laws to force people into slavery here, e. g. by forcing them to use US corporations ("if you do not have an app from Google store, you are excluded from society"). In that case they see age sniffing as ultimate tool of spying on everyone, so this is probably the real goal. What we all can see is that this has never been about children - they are just abused as the red hering here.

I'm confused on why browsers can't automatically handle the cookies pop ups. It's beyond annoying and something that should just be automated since my preferences don't change.

Consentomatic does most common cookie dialogs, according to your settings.

https://addons.mozilla.org/en-US/firefox/addon/consent-o-mat...

It also exists for other browsers.

I am not affiliated,but I have it on my devices and even on my phone, it's quite good and I very rarely get cookie popups now.

> I’m still having to deal with making some sort of legal agreement with EVERY website I visit over cookies constantly… I just don’t care anymore / click whatever.

That's the problem when you want to be pro-business while keeping the vague intent of protecting privacy.

They didn't mandate cookie banner, you can either not track or add a cookie banner. Of course businesses living off surveillance capitalism will chose the cookie banner. They could have banned tracking altogether, and chose not to because “it's bad for business”.

uBlock has lists you can enable for most of these.

Well, they really, really, really want the end game of tying (real) identity to digital identity. And they want it now, not 10+ years in the future when _theoretically_ there _might_ be some EU-friendly mobile operating system that everyone uses. Right now, Google and Apple are basically the entire smartphone market, so they gotta work with what they've got if they want these plans to come to fruition.

The EU gets billions of dollars from fining US companies. That money is used to pay for a lot of programs and the bean counters don't wan't that source of funding to dry up.

It used to say that, it was removed as a PR measure, while in practice the national implementations (as you do not use this app, but a national one) require it, because the specification only mandates Android/iOS versions to be provided (it allows others, but no government will do so), and it does not mandate them not to have "attestation".

This entire issue is a disaster of a Github issue. It looks like its on the entirely wrong repository. I did eventually find the text in another repository; the one for the Android reference implementation: https://github.com/eu-digital-identity-wallet/av-app-android...

It was removed from there to clarify the entire "Hey, this application is not done yet"

It being in the reference implementation instead of the spec is a massive difference. One means that it's just there to show an example, and we should push national governments to do it better in their implementations, while the other would mean that it'd be a requirement for all implementations, which it doesn't appear to be.

It also looks like the reference implementation removed that functionality entirely several months ago: https://github.com/eu-digital-identity-wallet/av-app-android...

From what I can gather from the linked discussion it was started as a pull request or a issue and was transferred to a discussion later. Perhaps some data was lost there? If you expand the comments fully there is also mention of a nuked merge request, I assume it was related to this text.

Edit it was not visible from the discussion link but it is visible from the issue link below. Also it seems to be transferred over from a totally different repo?

https://github.com/eu-digital-identity-wallet/av-doc-technic...

> Am I missing something?

Yes, that this post is propaganda.

Another juicy threat vector is forcing the app stores to stealthily ship a modified version of the app that sends copies of the IDs and/or tracking data to US intelligence services.

(Reminder: we know Persona's verification software already shares verification data with the federal government. It's a leap to modifying other apps, but within the realm of possibility of US government power. There is absolutely desire from them to gather blackmail material on politically important people, and age verification systems connected to adult sites/apps are a great way to do it)

This is a problem, but not the only one. The biggest one is that the phones in question are locked and deny user freedom. I would not be content with an European "alternative", but which is as locked as iOS.

Perhaps https://fsfe.org or https://edri.org can do that.

They are.

Step one in the "EU Firewall" and future credit system. Step out of line and get debanked or other things they will come up with to keep you inline.

Excellent point.

[flagged]

Even on the Android or iOS phone the EU app won't run if the device owner made even a tiniest change of the operating system without Google or Apple approval.

The EU developed system excludes the 1% of people for which the popular mobile solutions do not work and also make the rest 99% totally dependent on the selected corporations.

Why does it have to be a phone? Some people still use tablets, laptops and, believe it or not, desktop PCs.

Android derivatives are not considered enough, because they will not be Google-attested, so the app will refuse them.

This will ensure there never is.

You must realize, age verification is for more then just Googles Android apps.

Such a strong new legal framework must consider consumer hardware actually in use:

- Android variations Like GrapheneOS, Huawei's HarmonyOS, older phones running custom ROMs - Linux phones, which are sold in the EU and by EU companies

- Desktop operating systems

All of them can run Web Apps, and thus need age verification

My PinePhone runs postmarketOS and can technically run every modern Linux desktop "app".

Windows and Mac have billions of users.

Run linux?

> Are there any other Operating Systems than iOS, Android or Android flavors

Yes, there are many more: GNU/Linux, Windows, macOS, *BSD, etc.

This will prevent people who only own a computer and not a modern iOS/Android smartphone from accessing services and platforms.

This also sets a very strong anti-competition pressure. Which company will try now to invest on developing a new OS for smartphones if we already know users will not be able to access the most popular services & platforms with it?

Yes. LineageOS, GrapheneOS, Arch, Sailfish, various other open distros, Windows Phone, and a surprising number of random proprietary options (these are sometimes based on Android, and have some social media apps, but can't run regular Android apps that weren't specifically designed or altered for it) including for modern dumbphones. There are always more over time, too.

There's also old versions of iOS and Android. We don't want to end up in a situation where people are locked into one of only two vendors and can be forced to keep buying the newest model to use an ID app that only supports the most recent software. That'd be even worse for the environment than the current disposable smartphone culture.

Everything to do with the age verification push is corrupt and stupid to begin with. There isn't even a legitimate cause behind all this for forcing ANY app, even if it didn't also force people to buy a specific, expensive, privacy-invading American product.

as far as I'm aware, Adroid is not the same as the requirement here, which requires specific Google attestation.

There is GrapheneOS, HarmonyOS by Huawei, LineageOS for older phones and many more Android ROMs.

Additionally, Linux phones exist and are already sold in the EU to consumers, not just a prototype.

There's really no justification around limiting the OS selection.

There is also Linux, Windows, MacOS and many more operatint system not limited to phones.

> Are there any other Operating Systems than iOS, Android or Android flavors?

I remember a gov.uk team presentation. They had a usecase of someone using a PS Vita to access a government assistance program because that was the only device they had access to.

Among 450 million people in the EU there are definitely more OSes than just latest versions of iOS and Android.

> Are there any other Operating Systems than iOS, Android or Android flavors?

Like Windows, MacOS and Linux?

Even in a world where Android and iOS have 100% of market share, the law (including indirect but obvious consequences of the law) should not force using them.

SailfishOS, various incompatible blends of AOSP, KaiOS, and the Mocor based OSs run on various UNISOC based dumb phones

I'm on SailfishOS since a couple of years

In the thread you will find many examples of national implementations which do require attestation. It was removed from the README as a PR measure, but in practice the specification does not prohibit it, so national implementations will still use it.