Does anybody believe this?

Just swallowing their framing whole, huh?

So will there be an 'app' for FreeBSD desktop computers? For all the Linux variants?

What about those phones running Linux itself (not android)?

Sign me confused how this could work.

Online I keep hearing I'm supposed to be jealous of the EU with their great "UN Quality of Life Index" scores and whatnot, but it sure is getting heavy-handed over there.

Does anyone believe this will not be used to profile and track users? If you have to use ID to verify / validate against an app, how is that processed? Unless it's done offline in a secure enclave, the government / body will know you've uploaded the ID, and have all device identification, resulting in a large fingerprint. Once they know that, any site you visit can likewise be linked, resulting in the government knowing what you visit and what.

I've not against age verification, I'm against bad age verification. I've explained the idea a few times, but the short version, an online enclave downloads databases full of ID hashes, then disables any network connectivity, a full blackout. The offline enclave starts with a hard kill switch if any network connectivity is detected. The DBs will be transferred into the offline enclaves and the ID will be privately verified, with an age range stored. Then the ID and all DBs for this process are wiped, the enclaves are destroyed, and securely wiped, and network connectivity is restored.

Once that's done, you've verified your age, without handing over your paperwork, it's private, and accomplishes the same goal.

We need to know your identity, without knowing your identity.

Or, translated into realspeak...

Reduce freedom and increase government interference for poorly defined political purposes based on fear and ignorance

When I visited the UK last year, I went through customs. It took one of those facial recognition scans. There was no opt-out, there was no agent at the booth, I got no stamp in my passport.

Whatever system they're using already needs to be so pervasive that their solution to "papers, please" is to take the "paper" part out of it. This doesn't surprise me at all...but it would be somewhat fun to attempt using this app on a rooted phone.

I don't know if it was on purpose or not, but the app is very badly done, has been hacked with very simple techniques, for instance, one can reset the PIN just by opening one of the configuration xml files and deleting the PIN section, next time the app opens it asks for a new PIN, which was only stored in the device (also encrypted and not hashed), similar attacks remove facial and digital locks, and I'm sure many more bug will appear.

I expect a lot of comments on this article to be varieties of "this is terrible"... but it's really not, and I happen to have significant knowledge here. There is a big caveat, though, which I'll explain below.

First, the basic thing that makes strong, reliable age verification possible in the EU is national ID cards. In every EU country, as far as I know, you can get a national ID card basically from birth. A few issue at birth by default, but even those that don't allow parents to apply for cards for their kids at basically any age, and it's not uncommon.

I get the widespread American resistance to a national ID card, but I really think it's misplaced. There are risks, yes, but on balance the benefits are far larger.

Second, when the EU says you can verify your age without revealing your identity, they seriously mean it. I worked on the ISO 18013-5 mobile driving license standard, and its protocol is the basis for the age verification scheme (18013-5 also supports privacy-preserving age verification). The protocol enables cryptographically-secure privacy-preserving age verification, providing, essentially, a single cryptographically-verifiable bit answering the question "Is this person over age X", for specific legally-important ages. A great deal of effort goes into ensuring that the keys used to sign the bit cannot be linked to the identity of the person. One important element of that is the signing keys are single-use, so if your prove your age to two different web sites, they can't compare notes and notice that your proof of age used the same signing key, thereby proving that whoever you are, you visited both.

Note that under the 18013-5 design, if the verifier (e.g. the web site receiving proof of age) could collaborate with the issuer (the government), they could deanonoymize the holder (the person proving their age). Work is ongoing to devise protocols using group signatures or other cryptographic constructs that make verifier/issuer collusion fruitless. It's been a couple of years since I worked in this space, so I don't know if those new approaches have gone into production, but if they haven't, they will.

The big caveat I mentioned at the top is that there is no way for these systems to verify that the person who is providing age verification is the legitimate holder of the national ID upon which it's based. That is, a kid can steal their dad's ID and use it. Because the age verification is truly, strongly anonymous, there is no way for anyone to detect or prevent this... yet.

The "yet" is because people are working on incorporating privacy-preserving biometric authentication into the scheme. This is a little tricky because to provide privacy it's critical that the biometric acquisition and matching happen entirely in the user's device (or in the chip in the national ID card). But it can be done. Making it sufficiently secure, sufficiently reliable and sufficiently cheap is a significant engineering challenge, but it's being worked on. In another decade or so, the caveat may be removed.

If all of this seems silly to you... well, the age verification for porn may be, but the privacy-preserving selective proof technologies are general-purpose, and able to answer any age verification question any many other useful questions in a strongly privacy-preserving way. In any case where you need to prove something about yourself (age, city of residence, driving privileges, etc.) right now you need to provide the complete contents of your ID, which reveals far more about you than is necessary. The combination of cryptography, secure hardware and clever protocols used in this age verification can fix that, generally, enabling us to identify, authenticate or prove things about ourselves with only the minimal information absolutely necessary. It's a good thing.

And, honestly, it's a good idea to keep very young children away from porn.

That's not good enough. We need the app itself to be open source so that it can be audited if anyone wished to do so.

Otherwise, no one's going to trust it.

That wording!

Guaranteed to make old farts go ballistic.

Yet, here we are.

The COVID-19 certificates absolutely revealed the full identity of users. It had full names and date of birth encoded in it. It was entirely up to the implementation of the end user's app to respect the privacy of the scanee. E.g. the Austrians gave a green tick in their app, no further info. The Dutch provided first name, or last name, or month of birth, or day of birth, or year of birth, but never more than one at a time to verify against the person displaying the pass. But all of this information was sti

Make parents responsible for their kids. Stop with this nanny state bullshit. I know it's how the governments are framing their argument ("think of the children!") in order to try to sprinkle some seasoning on the shit salad they're trying to ram down our throats so they can track our every movement online to make it more palatable for the public to swallow, but come on!

Parents having to be responsible for what their kids are looking at online? Gasp! I'm so sick and tired of all this age verification cra

It starts...

When government overreach and business opportunity meat, there is tyranny.

Why not just avoid all this government involvement and just use Facebook as an OAUTH provider. I don't imagine there's anyone under 40 with a facebook account.

Yikes. I'm glad that didn't happen in my country.

I got a little covid card when I got my shots, which promptly went in the trash.

No tracking, just answer a question that prove your age!

Who recorded "Tiptoe Through the Tulips"?

"What would a physician do if he were on an island with Bo Derek"

"Who was Sergent Pepper"

Compared to that dumb OS requirement, I love this. If it can actually preserve anonymity, this is so much better.

I'm sure will piss off financial backers for all the full ID because we want to track and sell your data companies in the U.S. and/or the NSA/Admin who seem to want to fully track everyone too E.G. IME and the new personal router ban which black-box requirements for the exception that every company will need.