Doesn't work without a Google/Apple-tied device btw.

[raymaccarthy@mastodon.ie]

@pojntfx
But if you do use it you have lost privacy, Your information & identity can be exploited / controlled by government, corporations and criminals.

Better to be without!

The limited to Android / iOS is the wrong argument, as that accepts what shouldn't exist at all, ever, anywhere.

[someplaceunknown@mastodon.social]

@pojntfx FYI it's been hacked already

Paul Moore - Security Consultant  (@Paul_Reviews)

Hacking the #EU #AgeVerification app in under 2 minutes. During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory. 1. It shouldn't be encrypted at all - that's a really poor design. 2. It's not cryptographically tied to the vault which contains the identity data. So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app. After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid. Other issues: 1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying. 2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step. Seriously @vonderleyen - this product will be the catalyst for an enormous breach at some point. It's just a matter of time.

Nitter (xcancel.com)

[elricofmelnibone@mastodon.social]

@pojntfx The Commission is seriously fueling anti-EU sentiment with this garbage.

[imgoneinpeace@mastodon.social]

@pojntfx this bitches want to change the meaning od the word "open source" now. What a bunch of shameless parasites.

[robinadams@mathstodon.xyz]

@kirakira @pojntfx The relevant law is the Digital Services Act which requires that "Platforms must take measures to safeguard minors on their services, such as reducing the risks of exposure to age-inappropriate content like gambling or pornography. The DSA also introduces a complete ban on showing targeted advertisements to children."

The Digital Services Act

The Digital Services Act helps to make the online environment safe and trustworthy.

Shaping Europe’s digital future (digital-strategy.ec.europa.eu)

[landelare@mastodon.gamedev.place]

@pojntfx You see, it's really important for EU sovereignty that they're tying this to two US-based companies, their whims, and their—currently, very predictable, and just as reliable—government's whims. Very sovereign.

[raffkarva@sunny.garden]

@zed

Let's not victim-blame please.

Predatory companies with addictive algorithms are the issue here. Pointing fingers at parents is how we ended up here.

All we have to do is ban algorithms and/or for-profit social media. That's it. All problems solved overnight.

[d4v@mastodon.social]

@pojntfx This app is a joke, not speaking about the vulnerabilities it got as someone mentioned earlier

[erikjonker@mastodon.social]

@dukeboitans @soulsource @pojntfx ...I wish you lots of fun with all those people on mobile phones that are not using the Google or Apple platform there, it is an incredibly small niche. We can argue about the functionality, whether it is needed, useful but not any app that you can use on current smartphones in the Apple/Google ecosystem is inherently bad/garbage. Ofcourse you can be against age verification as such, there are arguments against that I agree, but many Parliaments want it.

[dukeboitans@mas.to]

@ErikJonker @soulsource @pojntfx We need portable software, a concept even older than me. This application could have been engineered to be portable from the start, instead they cheaped out, with hard requirements like having a Google/Apple smartphone. This is unacceptable.

[lacze@hear-me.social]

@TimothyRoes @pojntfx @jolla

GrapheneOS (@GrapheneOS@grapheneos.social)

GrapheneOS will remain usable by anyone around the world without requiring personal information, identification or an account. GrapheneOS and our services will remain available internationally. If GrapheneOS devices can't be sold in a region due to their regulations, so be it.

GrapheneOS Mastodon (grapheneos.social)

[erikjonker@mastodon.social]

@dukeboitans @soulsource @pojntfx ...sadly the current hardware of smartphones offers security features that are only available on Apple and Google platforms I understood (bad in itself I agree)

[luc0x61@mastodon.gamedev.place]

@pojntfx EU fails again in being European, tying again European citizens to an US duopoly.
Another loud epic failure.

[rainer@johnmastodon.eu]

@TimothyRoes @khleedril @K4mpfie @ErikJonker @soulsource @pojntfx I guess an alternative is described here: https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui/issues/390

[valentin@mastodon.social]

@pojntfx Product idea: a usb+nfc token (like Yubikey or other security keys), that runs Android in it to log in on banks and social medias from other platforms.

[crocmagnon@fosstodon.org]

@pojntfx the article linked says "the app works on any device – phone, tablet, computer, you name it". Do you have evidence that this isn’t true?

[archivescribe@mastodon.social]

@pojntfx Our governments will not be satisfied until we're all treated like caged animals. Incredibly disappointing.

[soulsource@mastodon.gamedev.place]

@rainer @TimothyRoes @khleedril @K4mpfie @ErikJonker @pojntfx

Which also is system-specific and therefore not portable.

What we are dealing with is a trade-off between usability, security and portability. The current approach emphasises the first two strongly over the third.

Since this is a gate-keeper app, where everyone who does not have access will also not have access to certain websites, I think a higher priority should be given to portability, even if it lowers usability or security.

[soulsource@mastodon.gamedev.place]

@ErikJonker @dukeboitans @pojntfx Indeed. The trade-off would be to either have lower security (impersonation risk) or worse usability (e.g. 2-factor authentication).

Since age verification is going to be a gate-keeper that will lock out everyone who does not have access to a verification tool from large parts of the internet, I think it is at least worth considering the "worse usability" option as an alternative for users who do not have access to an Android/iOS phone with Device Attestation.

[soulsource@mastodon.gamedev.place]

@ErikJonker @dukeboitans @pojntfx Thinking about it: The press statement mentions that desktop platforms will be supported.

So, if we take that seriously, and considering that this is just the start, then I guess we can later expect a desktop application, or even a website, that does exactly that: Trade usability for portability.

Similarly to how the ID Austria is handled: You can either use the Android/iOS app (easy to use, non-portable), or use a FIDO token (portable, but worse usability).