Doesn't work without a Google/Apple-tied device btw.

[timothyroes@mastodon.social]

@K4mpfie @ErikJonker @soulsource @pojntfx This project has little to do with the digital sovereignty push, it's an implementation of the Digital Services Act.

[susannedoering@zirk.us]

@pojntfx Can that be legal?

[timothyroes@mastodon.social]

@pojntfx This is something I'm also looking into as I've ordered a @jolla phone and so many government identity apps don't work on there. But this is novel terrain for everyone.

It might be arguable to say this amounts to granting special or exclusive rights to Apple and Google, which could be problematic under Article 106(2) TFEU. I'd also argue that it facilitates an abuse of dominance, in violation of Article 102 TFEU read together with Article 4(3) TEU.

[luboganev@androiddev.social]

@pojntfx have you found in the code hard dependencies that can't be abstracted and satisfied with alternatives? I checked it quickly and the reference implementation looks very flexible and modular, so if a government wants to build it also for other OS it should be doable but I'm not 100% sure, that's why I am asking if you found road blockers in the repo?

[brekke@eupolicy.social]

If a) public discourse and democratic participation is happening online, and b) age verification is necessary to be allowed to participate in this discourse, then the app proposed here is actively gatekeeping democratic participation. You could go as far as to say that those who cannot use this app would no longer be full citizens.

Even if this only badly affected 0.1% of Europeans, that would be something like 400 000 people degraded to second-class citizens.
@ErikJonker @soulsource @pojntfx

[regendans@todon.eu]

FWIW, I guess this could still work with Waydroid on a desktop computer. https://waydro.id/ #opensource #android #waydroid

[khleedril@cyberplace.social]

@TimothyRoes @K4mpfie @ErikJonker @soulsource @pojntfx Give with the right hand, take with the left...

[eliasp@mastodon.social]

@regendans unlikely, if it depends on device attestation.

[kaito02@mastodon.social]

@jelte @ErikJonker "Oh you don't have an iPhone? Just use Android!"

[corb_the_lesser@mastodon.social]

@pojntfx Equating the risks of using the products of Big Tech with the risks of consuming alcohol is... interesting.

[meneerdebruin@mastodon.nl]

@brekke @ErikJonker@mastodon.social @soulsource @pojntfx The discussion should revolve about why we would need this and for what. And then, and only then, how we would implement this.

Especially as the alcohol checks work so well. Not.

[zed@mstdn.party]

@pojntfx @EUCommission

The same parents who aren’t able or willing to curb their own internet addiction are perplexed that their children are addicted, and so now we have a problematic implementation of age verification for minors (which isn’t even related to the issue of social media being toxically addictive). Amazing work EU.

[timothyroes@mastodon.social]

@khleedril @K4mpfie @ErikJonker @soulsource @pojntfx It is indeed not entirely coherent yet. I'd be interested to get more details on the technical background: why is a call to Apple and Google required for the moment? Is this to certify that it's the original, unchanged version of the app? And what's the open source alternative to that certification? Let me know if you can help, I'd like to work on a legal argument to open this up

[jose206@mastodon.social]

@pojntfx

[brekke@eupolicy.social]

Absolutely. It's far from obvious that kids should be banned from online participation in the first place. I'd argue their right to political participation kicks in way before their right to vote, and there are plenty of online spaces that do good things for kids that might otherwise have a hard time.

As @ErikJonker agreed that it's questionable whether this app could actually serve a worthy purpose, I started my post in the thought experiment that it could. @MeneerDeBruin @soulsource @pojntfx

[dukeboitans@mas.to]

@ErikJonker @soulsource @pojntfx Mandatory age verification is hardly improving anything, esp. if tied to Google/Apple accounts. Also you can very easily lose your Google account and be effectively blocked out of all public discourse. This is garbage tech that should have never be allowed to exist.

[raymaccarthy@mastodon.ie]

@pojntfx
But if you do use it you have lost privacy, Your information & identity can be exploited / controlled by government, corporations and criminals.

Better to be without!

The limited to Android / iOS is the wrong argument, as that accepts what shouldn't exist at all, ever, anywhere.

[someplaceunknown@mastodon.social]

@pojntfx FYI it's been hacked already

Paul Moore - Security Consultant  (@Paul_Reviews)

Hacking the #EU #AgeVerification app in under 2 minutes. During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory. 1. It shouldn't be encrypted at all - that's a really poor design. 2. It's not cryptographically tied to the vault which contains the identity data. So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app. After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid. Other issues: 1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying. 2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step. Seriously @vonderleyen - this product will be the catalyst for an enormous breach at some point. It's just a matter of time.

Nitter (xcancel.com)

[elricofmelnibone@mastodon.social]

@pojntfx The Commission is seriously fueling anti-EU sentiment with this garbage.

[imgoneinpeace@mastodon.social]

@pojntfx this bitches want to change the meaning od the word "open source" now. What a bunch of shameless parasites.