• dolle@feddit.dk
    link
    fedilink
    arrow-up
    3
    ·
    10 days ago

    Det er beskrevet hvordan her: https://ageverification.dev/

    Jeg synes dog at der mangler detaljer, da jeg umiddelbart forudser at det bliver nemt at misbruge fordi certifikater kan kopieres uden at man kan spore personerne bag. Jeg frygter derfor at det kommer til at afhænge af Play Integrity, eller værre, at det bliver erstattet af en mindre privat løsning med en bagdør så myndighederne kan af-anonymisere. Overordnet er jeg heller ikke fan af at gøre det et krav at du kun kan tilgå internettet hvis du har en smartphone. Var det ikke sådan nogle vi lige var blevet enige om gjorde de unge triste?

    • farsinuce@feddit.dk
      link
      fedilink
      arrow-up
      3
      ·
      edit-2
      8 days ago

      Det ser ud til, du har ret, @[email protected].

      Fandt dette (tyvstjålet fra reddit):

      EU age verification app to ban any Android system not licensed by Google

      The EU is currently developing a whitelabel app to perform privacy-preserving (at least in theory) age verification to be adopted and personalized in the coming months by member states. The app is open source and available here: https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui.

      Problem is, the app is planning to include remote attestation feature to verify the integrity of the app: https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui?tab=readme-ov-file#disclaimer. This is supposed to provide assurance to the age verification service that the app being used is authentic and running on a genuine operating system. Genuine in the case of Android means:

      • The operating system was licensed by Google
      • The app was downloaded from the Play Store (thus requiring a Google account)
      • Device security checks have passed

      While there is value to verify device security, this strongly ties the app to many Google properties and services, because those checks won’t pass on an aftermarket Android OS, even those which increase security significantly like GrapheneOS, because the app plans to use Google “Play Integrity”, which only allows Google licensed systems instead of the standard Android attestation feature to verify systems.

      This also means that even though you can compile the app, you won’t be able to use it, because it won’t come from the Play Store and thus the age verification service will reject it.

      The issue has been raised here https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/issues/10 but no response from team members as of now.