Doesn't work without a Google/Apple-tied device btw.

[zed@mstdn.party]

@pojntfx @EUCommission

The same parents who aren’t able or willing to curb their own internet addiction are perplexed that their children are addicted, and so now we have a problematic implementation of age verification for minors (which isn’t even related to the issue of social media being toxically addictive). Amazing work EU.

[timothyroes@mastodon.social]

@khleedril @K4mpfie @ErikJonker @soulsource @pojntfx It is indeed not entirely coherent yet. I'd be interested to get more details on the technical background: why is a call to Apple and Google required for the moment? Is this to certify that it's the original, unchanged version of the app? And what's the open source alternative to that certification? Let me know if you can help, I'd like to work on a legal argument to open this up

[jose206@mastodon.social]

@pojntfx

[brekke@eupolicy.social]

Absolutely. It's far from obvious that kids should be banned from online participation in the first place. I'd argue their right to political participation kicks in way before their right to vote, and there are plenty of online spaces that do good things for kids that might otherwise have a hard time.

As @ErikJonker agreed that it's questionable whether this app could actually serve a worthy purpose, I started my post in the thought experiment that it could. @MeneerDeBruin @soulsource @pojntfx

[dukeboitans@mas.to]

@ErikJonker @soulsource @pojntfx Mandatory age verification is hardly improving anything, esp. if tied to Google/Apple accounts. Also you can very easily lose your Google account and be effectively blocked out of all public discourse. This is garbage tech that should have never be allowed to exist.

[raymaccarthy@mastodon.ie]

@pojntfx
But if you do use it you have lost privacy, Your information & identity can be exploited / controlled by government, corporations and criminals.

Better to be without!

The limited to Android / iOS is the wrong argument, as that accepts what shouldn't exist at all, ever, anywhere.

[someplaceunknown@mastodon.social]

@pojntfx FYI it's been hacked already

Paul Moore - Security Consultant  (@Paul_Reviews)

Hacking the #EU #AgeVerification app in under 2 minutes. During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory. 1. It shouldn't be encrypted at all - that's a really poor design. 2. It's not cryptographically tied to the vault which contains the identity data. So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app. After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid. Other issues: 1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying. 2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step. Seriously @vonderleyen - this product will be the catalyst for an enormous breach at some point. It's just a matter of time.

Nitter (xcancel.com)

[elricofmelnibone@mastodon.social]

@pojntfx The Commission is seriously fueling anti-EU sentiment with this garbage.

[imgoneinpeace@mastodon.social]

@pojntfx this bitches want to change the meaning od the word "open source" now. What a bunch of shameless parasites.

[robinadams@mathstodon.xyz]

@kirakira @pojntfx The relevant law is the Digital Services Act which requires that "Platforms must take measures to safeguard minors on their services, such as reducing the risks of exposure to age-inappropriate content like gambling or pornography. The DSA also introduces a complete ban on showing targeted advertisements to children."

The Digital Services Act

The Digital Services Act helps to make the online environment safe and trustworthy.

Shaping Europe’s digital future (digital-strategy.ec.europa.eu)

[landelare@mastodon.gamedev.place]

@pojntfx You see, it's really important for EU sovereignty that they're tying this to two US-based companies, their whims, and their—currently, very predictable, and just as reliable—government's whims. Very sovereign.

[raffkarva@sunny.garden]

@zed

Let's not victim-blame please.

Predatory companies with addictive algorithms are the issue here. Pointing fingers at parents is how we ended up here.

All we have to do is ban algorithms and/or for-profit social media. That's it. All problems solved overnight.

[d4v@mastodon.social]

@pojntfx This app is a joke, not speaking about the vulnerabilities it got as someone mentioned earlier

[erikjonker@mastodon.social]

@dukeboitans @soulsource @pojntfx ...I wish you lots of fun with all those people on mobile phones that are not using the Google or Apple platform there, it is an incredibly small niche. We can argue about the functionality, whether it is needed, useful but not any app that you can use on current smartphones in the Apple/Google ecosystem is inherently bad/garbage. Ofcourse you can be against age verification as such, there are arguments against that I agree, but many Parliaments want it.

[dukeboitans@mas.to]

@ErikJonker @soulsource @pojntfx We need portable software, a concept even older than me. This application could have been engineered to be portable from the start, instead they cheaped out, with hard requirements like having a Google/Apple smartphone. This is unacceptable.

[lacze@hear-me.social]

@TimothyRoes @pojntfx @jolla

GrapheneOS (@GrapheneOS@grapheneos.social)

GrapheneOS will remain usable by anyone around the world without requiring personal information, identification or an account. GrapheneOS and our services will remain available internationally. If GrapheneOS devices can't be sold in a region due to their regulations, so be it.

GrapheneOS Mastodon (grapheneos.social)

[erikjonker@mastodon.social]

@dukeboitans @soulsource @pojntfx ...sadly the current hardware of smartphones offers security features that are only available on Apple and Google platforms I understood (bad in itself I agree)

[luc0x61@mastodon.gamedev.place]

@pojntfx EU fails again in being European, tying again European citizens to an US duopoly.
Another loud epic failure.

[rainer@johnmastodon.eu]

@TimothyRoes @khleedril @K4mpfie @ErikJonker @soulsource @pojntfx I guess an alternative is described here: https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui/issues/390

[valentin@mastodon.social]

@pojntfx Product idea: a usb+nfc token (like Yubikey or other security keys), that runs Android in it to log in on banks and social medias from other platforms.