The whole thing is wrongheaded in the first place; any child wanting to access adult-only content will use an adult’s account to do so; any adult attempting to access adult-only content is likewise going to use an adult’s account.
So unless they’re tying this to biometrics that are actually secure against an adverserial child, all the system really does is creates a registry of adults. And we already have those.
yelling_at_cloud@programming.dev
on 06 Aug 20:35
collapse
Iirc a portrait photo is a part of the mandatory dataset for the EUDI now
irotsoma@piefed.blahaj.zone
on 05 Aug 23:26
nextcollapse
Creating a registry of adults and what content they access is exactly the point of these laws. Always has been. “Protecting children” is just the easiest excuse to make it seem more urgent to violate people’s rights. Just like removing trans healthcare started with children and is now targeting adults.
Thing is, it doesn’t create a registry of what content adults access. Just what content their registered identity accesses.
irotsoma@piefed.blahaj.zone
on 06 Aug 00:33
collapse
But in most cases, it is, because most adults are not that technically inclined to get around the logins. Sure there are some tech savvy ones who will bypass it. And maybe a few kids who will use their parents’ accounts rather than just bypassing the logins but it’s still the family accessing the information, but for the majority, it does work as a registry. And though it’s only on a few categories of sites now, the categories inevitably will expand. It’s not just porn, but info on reproductive and gender healthcare, LGBTQ+ dating, and many other subjects that “children must me protected from”, but really they want to know who’s gay, looking for abortions or transgender healthcare or information about whatever other rights their government is trying to force them to give up.
EnsignWashout@startrek.website
on 06 Aug 23:46
collapse
Yes. And perhaps, given time, accessing the wrong version of certain sensitive historic events could even be tracked that way.
irotsoma@piefed.blahaj.zone
on 07 Aug 20:00
collapse
It already is. In China if you access information on the Tiananmen Square massacre it has gotten you flagged for ages. In the US, if you access pro-Palastine information or abortion information, these things are then used to prove you are antisemitic or trying to get an abortion where it’s illegal, etc. The easier it is to link that access to an individual through a registry, the more commonly it will be used.
FineCoatMummy@sh.itjust.works
on 06 Aug 02:40
nextcollapse
Wasn’t there something about the effectiveness of the Australian law to restrict minors on social media? Ah…
Experts say law not enough to stop children accessing harmful content online and more ‘convincing strategy is required’ . More than 80% of under-16s in Australia said they were still using social media three months after legislation banning them from it came into force, research shows.
It’s like any controlled substance ban — unless there’s a really invasive crack-down it just shifts the problem to a less safe black market.
Making things easy and safe to access with controls that are adjustable is always more effective than an outright ban that shifts the access fully into unregulated territory.
hirihit640@sh.itjust.works
on 07 Aug 09:38
collapse
I think they expect the parent to secure their own account to make sure their child can’t use it. And anyways, it shifts accountability. If the parent lets the child use their account, then the parent takes the blame. If the child gets addicted to social media, that becomes the parent’s fault for giving the child unrestricted access.
akunohana@piefed.blahaj.zone
on 05 Aug 21:12
nextcollapse
Please explain… If I’m below the age of… Whatever they decide, what will or will not be accessible to me? Like, if I’m below a certain age, will some EU appointed DNS restrict what domains I can reach? Or, since this article is about hardware-bound attestation, are my devices going to prevent me from installing and using certain apps if I’m below the age? I don’t understand where the restrictions are going to lie…
Bonus: can’t I just buy, say, five phones right now, root them or install custom OSs before shit hits the fan and be happy?
it_depends_man@lemmy.world
on 05 Aug 21:59
nextcollapse
First of all,
I don’t understand where the restrictions are going to lie
Yes. That’s exactly the question.
The point of the… excitement around this is exactly the uncertainty. We simply don’t know what the EU or national governments of the EU will do with this.
The first problem is that the “hardware bound attestation” isn’t just hardware bound, it’s specifically Apple and Android’s attestation and NOT the more open standard. That means the device that can do this thing, whatever it’s going to be “necessary” for, MUST always be an Apple or Google device, with that bit intact. Tbh, I don’t really know how much rooting affects this, but I would be surprised if it didn’t.
The second problem is that once the infrastructure for blocking access to something and requiring this sort of authentication is in place, it’s just a list of targets. It’s very easy to add another platform, website, app or anything else behind it.
And the reason for this excitement happening now is that the specification that was given for all this to happen previously only said it should be “secure” somehow, but not detailing the “how”. They think they can do it as an implementation detail and pretend it’s not a big deal. So it’s very clearly something those bastards have tried to be sneaky about.
Can you use rooted phones
No, whatever the point of their efforts is, they will make sure to not leave obvious loopholes like that open.
The services themselves will probably be made to ask for verification and your devices will answer through the age verification app. Since custom mobile OSs (or desktop Linux) won’t provide hardware attestation, the app won’t work on them and the websites will treat you as underage. The types of services that require age verification aren’t specific, they can change based on EU decisions so eventually people not using “approved” OSs may be locked out of most of the internet.
humble_boatsman@sh.itjust.works
on 06 Aug 01:18
nextcollapse
And you can be damn sure this will infest necessary government services and apps that won’t allow you to contact the government in any other way.
FineCoatMummy@sh.itjust.works
on 06 Aug 02:51
nextcollapse
so eventually people not using “approved” OSs may be locked out of most of the internet
Agree 100%. I hope everyone realizes this! I have seen too many ppl who think, “It’s OK, open source will save us”. But open source can’t. This is a legal and social prob, and needs a legal and social solution.
ParlimentOfDoom@piefed.zip
on 06 Aug 14:55
collapse
Oh neat, they broke the Internet, since everything is hosted on Linux…
irelephant@lemmy.dbzer0.com
on 06 Aug 17:53
collapse
This wouldn’t impact the backend of these services, the age checking stuff would run on the client, this only breaking Linux (barring android) clients.
SocialistVibes01@lemmy.ml
on 05 Aug 22:15
collapse
The real explanation is that they want control. The children are a excuse.
No because you can go to jail for that, like the dude with his GrapheneOS in the US. They’re probably working on that next.
fluffykittycat@slrpnk.net
on 06 Aug 10:10
nextcollapse
The fact that children can be deprived of rights with only the vaguest unproven assertion of “safety” is a critical threat to the rights of everyone
No because you can go to jail for that, like the dude with his GrapheneOS in the US. They’re probably working on that next.
no… you can not go to jail, in the EU or the US at least, for having a phone with a custom OS. They are facing charge for using a duress code which wiped their phone. It is very different.
anotherspinelessdem@lemmy.ml
on 05 Aug 23:34
nextcollapse
You simply outlaw imports of noncompliant hardware. So you’re limited to smugglers.
When general computing is outlawed, only outlaws will have general computers.
Can’t wait for EU to ban general purpose computing. At some point ,everybody is just going to get a locked down Windows tablet where only EU approved software runs.
BottleBoardBakon@lemmy.ml
on 06 Aug 06:00
nextcollapse
They’re gonna ban abacuss next, and then comes mental math, and suddenly 2+2=fish
Ophrys@lemmy.dbzer0.com
on 06 Aug 08:19
nextcollapse
Can’t wait to become a shady dealer who sells pre 2026 computers with highly illegal software running on it (such as debian)
isleepinahammock@lemmy.blahaj.zone
on 06 Aug 22:38
collapse
Honestly, it’s something where I wonder if we’re doomed to end up there anyway.
I think that the AI companies vastly overstate the usefulness and danger represented by AI models. But the technology is only getting better, and the resources required to run models will decrease over time.
A common scenario brought up are AIs teaching people how to make biological weapons. Can existing LLMs actually do that? I really don’t know. I for one don’t feel like asking copilot, “please give me step-by-step instructions for obtaining and weaponizing anthrax, in steps simple enough someone with only a general science and engineering background can do.” I’m curious what copilot would say. But I won’t be asking copilot that, not because I’m incurious, but because I don’t feel like getting my house raided by the FBI.
But imagine a world where that actually is possible. Forget the claims of Sam Altman. Let’s look 50 years ahead in the future. Imagine being able to ask that question to an open-weight/model LLM, something you can run unmonitored on a home desktop, and actually getting a correct response. Imagine being able to ask endless follow-up questions. A good enough LLM could conceivably walk someone with only a high school education through all the steps needed to create weaponized anthrax from scratch.
Anthrax is something we actually can’t control the spread of. It occurs naturally in the soil and water in some specific locations and conditions. A sufficiently skilled biochemist could go out, collect it, and culture it. And having an LLM capable of giving you step-by-step instructions, dumbed down to whatever your skill level is? Able to coach you through it, perhaps even watch you do it and offer real-time feedback? If you just have to act as the hands of the LLM? Suddenly anyone can weaponize anthrax.
I don’t think existing LLMs are there yet. But what do we actually do if we reach a point where open-source LLMs are? What are we supposed to do when the knowledge to produce weapons of mass destruction becomes cheap and accessible?
A general trend in technology over time is that it has magnified the potential destructive power of a single individual. How can a society survive when anybody has the ability to kill everybody? I just don’t see how you keep society going except by locking down the tech. Maybe require a license for any computer over a certain power. And such computers are heavily surveilled. So you can have a free and private computer, but only if that computer does not make you a danger to everyone around you.
I just don’t know how else a civilization can survive the democratization of weapons of mass destruction.
FineCoatMummy@sh.itjust.works
on 06 Aug 23:30
collapse
As much as I’m a privacy guy, those are legit concerns IMO. IDK where the future goes, but I see reasons to worry.
TBH I’m more worried about the overall infopocalypse that’s already in progress. But I also can’t rule out an AI teaching somebody unhinged how to make a devastating biological weapon. Something only accessible in the past to very highly trained ppl, who were not gonna do that.
But I also want my privacy! And I believe privacy is essential to a functional democracy. Feels like every choice is a bad choice.
isleepinahammock@lemmy.blahaj.zone
on 06 Aug 23:42
collapse
Yeah, that’s why in an ideal case, I could see a two-tier model developing. Similar to how we handle weapons today. At least in the US, handguns and rifles are pretty obtainable. But anything more than that is heavily restricted. Even 2nd Amendment folks don’t advocate for the private ownership of heavy artillery, FPV suicide drones, armed tanks, etc. We allow anyone to own the things that, while still dangerous, don’t give you the power to kill absurd numbers of people. Even with an AR-15, you’re only taking out so many people before you’re taken down. You’re not a danger to civilization by owning an AR-15.
Computers could work the same way. As AI technology improves, we’ll get a better understanding of the minimum level of compute needed to be dangerous. You then set a limit for unlicensed computing below that level. Unlicensed? Have all the privacy you want. This lets you play games and create text, video, and most any form of expression you want. If your creative medium is as an artist of fully immersive 4K virtual reality worlds, you might have some trouble. But pretty much anything you currently use a computer for would fall under the unlicensed compute threshold.
Above this threshold? Everything is locked down. Everything is logged. Everything is scanned. You’re using a tool that is as dangerous as a pile of plutonium, and we treat it with an appropriate level of respect. Dealing with this privacy violation is just a price you have to pay if you want to use these tools.
FineCoatMummy@sh.itjust.works
on 06 Aug 23:45
collapse
IDK, I’m less sold on your proposed solution, than on your proposed problem existing. :)
DieserTypMatthias@lemmy.ml
on 06 Aug 10:00
nextcollapse
The solution lets users prove they are over a certain age without revealing their name, exact birth date, or full identity document. To prevent credentials from being copied, cloned, or reused by modified clients, the project relies on keys stored in protected hardware like Android TEE, StrongBox, or Apple’s Secure Enclave.
The project’s technical specification requires age verification apps to use native cryptographic hardware when available. However, stricter checks like root detection, Google Play Integrity, and Apple App Attest are not universally mandated by the reference implementation and may be left to individual deployers.
So there’s a chance that GrapheneOS will be supported. I mean, we can still decompile the app, modify it and then repackage it. Or someone will make a patcher app.
jenesaisquoi@feddit.org
on 06 Aug 11:36
nextcollapse
I think the when available part is key.
quick_snail@feddit.nl
on 06 Aug 17:20
nextcollapse
I would expect it must be open source, so I don’t known why you’d decompile it
irelephant@lemmy.dbzer0.com
on 06 Aug 17:51
nextcollapse
DieserTypMatthias@lemmy.ml
on 06 Aug 18:19
nextcollapse
Because some member states argue that their implementation is better when proprietary. Also if you’ll want to build the app yourself, you’ll need the required certs.
yelling_at_cloud@programming.dev
on 06 Aug 20:32
collapse
Unfortunately not, the wallet app must have source code available except for parts deemed too sensitive, which are exempt
yelling_at_cloud@programming.dev
on 06 Aug 20:30
collapse
I would love to be wrong about this, but I don’t think it’s likely. Why would a government voluntarily spend money on making the app work for a minority of people running a privacy OS that politicians associate with criminals and gangsters?
Also, it’s not like the wallet app will actually be open source in the traditional sense where you can fork and compile it yourself, so I think getting any decent version of it seems like a long shot
isleepinahammock@lemmy.blahaj.zone
on 06 Aug 22:17
nextcollapse
I have a solution to the age verification problem. There is a way to affirmatively prove someone is a real human adult without invasions of privacy. We can use the same ID verification system we’ve been using for centuries: public notaries.
Governments could hand anonymous cryptographic tokens to notaries. These contain no information on the individual. They’re simply a unique cryptographic token. You can go to a notary, pay a nominal fee, show your ID, and grab one of the tokens (possibly just a code printed on a card) from a large bin of them. You can then use this token to register for any number of sites. The notary themselves does not need to note which cryptographic token you grab. The notary doesn’t even know what token you received. The goal is merely to prove you’re an adult human, not to create a cryptographic key tied to your specific identity.
I would then let people do this as many times as they want. You can get a hundred such IDs. They wouldn’t cost much, a few dollar or Euros. This would be no barrier to individuals accessing the net, but it would make them unsuitable for mass spamming.
FineCoatMummy@sh.itjust.works
on 06 Aug 23:38
nextcollapse
It’s a legit idea, and there’s a thing like that, called Zero Knowledge Proofs (ZKP).
IMO it’s possible in theory. Like set up and managed in good faith, it can work mathematically, and you can prove it does.
My worry tho is that it wouldn’t be in good faith. It’ll be corrupted somehow. Or it turns out that enough other signals leak that it isn’t very effective. Like fingerprinting and stylometry and w/e allow ID’ing despite the ZKP layer.
Maybe I missed something, but with your proposed solution, what would stop someone from just handing the adult cryptographic token to a kid? It sounds like it would be a similar situation to or even easier to do than fake ID cards or adults buying alcohol for underage people.
isleepinahammock@lemmy.blahaj.zone
on 07 Aug 02:10
collapse
Nothing. Who says a solution has to be perfect? If “good enough” is good enough for handling the sale of alcohol, it can certainly be good enough for accessing web sites. No solution to any problem is perfect. You always have to find a balance between preventing the thing you want to stop and the negative effects of your efforts to prevent that thing.
It’s not as good as the solution for alcohol as one bottle of beer making it to a child gets used up after only giving one child one drink. Once a token leaks, it can be shared again and again and used by arbitrarily many children arbitrarily many times until someone notices that it’s leaked and revokes it (which then means that websites need to actively update a list of revoked tokens instead of just relying on public key cryptography to confirm it was signed by one of a few authorities, or all tokens will need to expire automatically after a short time).
isleepinahammock@lemmy.blahaj.zone
on 07 Aug 21:18
collapse
That will always be the case for online age verification. There’s nothing preventing an adult from signing up for an account and then just giving the account to a kid. This is true no matter the verification method chosen. Unless you’re going to demand people scan their face every time they log in, and even then there are ways around it.
My goal is not to create a perfect solution. My goal is to create a good-enough solution that is as reliable as face or ID scanning, but without the privacy violations.
And face/id scanning aren’t as good as the solution that works in the real world for alcohol because they can be tricked by a video game face or a photo of someone else’s real ID. Any solution that works online can either be trivially bypassed or adds an unacceptable level of hassle and risk (e.g. leaks being used for blackmail) for legitimate users.
The solution for alcohol works really well because very few children have the ability to get a fake ID or convince people it’s real and theirs until they’re close enough to legal age that it doesn’t really matter much if they drink, and parents have the ability to override it on a per-drink basis if they’re okay with children drinking under their supervision, while non-parents can only operate on a very small scale before they risk getting caught. Once people are old enough that they’re obviously adults, they don’t get asked for ID anymore, so it’s only a small fraction of the population that have to deal with any hassle, and a shopkeeper can’t memorise every single ID card they’ve ever seen and then suffer a cyberattack and reveal what alcohol specific people have bought to someone who’ll threaten all of them in case some of them are willing to pay to have it kept secret.
Preserving privacy means tokens become trivial to share, and then there’s nothing stopping a ten year old watching huge amounts of extreme porn except for things that would have worked without having any system, like having their parent stand behind them. If the new system doesn’t improve things compared to having no system, then there’s no point making it.
thanksforreading@lemmy.ml
on 07 Aug 11:48
nextcollapse
It would only work if the law mandated that this token cannot be stored or tracked across the web.
I think the idea is that you can use different tokens for each thing.
thanksforreading@lemmy.ml
on 08 Aug 11:31
collapse
Right but people won’t and if you do they can still track you by combining other metadata
NewNewAugustEast@lemmy.zip
on 07 Aug 20:29
nextcollapse
No. There is zero need for this shit, don’t normalize it.___
isleepinahammock@lemmy.blahaj.zone
on 07 Aug 21:15
collapse
There is a clear need for it. There’s value in having online discussion spaces that aren’t just swamped with bots. We really need a reliable way of telling human from bot. I want to find a way to do that preserves privacy to the greatest degree possible.
Do you have any constructive criticism to offer? Maybe a suggested improvement, or an alternative way to accomplish the same goal? What’s your solution to separate human from bot?
NewNewAugustEast@lemmy.zip
on 07 Aug 21:35
collapse
There is no need for it. Sorry. Certainly not government mandated, which is the worst part.
Frankly if you treat the internet like was did all the way back in bbs days, it doesn’t matter that much: Everyone is a liar. So I don’t care what anyone says. Bot or not.
In the forums I run we haven’t seen much of a bot presence at all, so these spaces already exist. How do I know? We have all met each other at one point or another. So I may know a, a knows b, and so on.
Do I want the burden of starting authentication on top of this? No.
I don’t want the internet to require me to get authentication. I really don’t care about the bot issue. Go outside and meet people in real life if that’s what you want.
isleepinahammock@lemmy.blahaj.zone
on 07 Aug 22:07
collapse
There is no need for it. Sorry. Certainly not government mandated, which is the worst part.
YOU have no need of it. You’re projecting your experiences onto everyone else. Maybe you’re content only hanging out in limited forums where you have to know someone to join. And those forums can continue to operate without any human verification. If you don’t care whether the spaces you occupy are infested with bots, or can manage with white lists, fine. But most people don’t want to talk to bots. Not everyone has the social connections you do.
I don’t support mandating ID for anything. But you are not the only person in the world. Just because you have no need of it, doesn’t mean no one does. Not everyone uses the internet the same way you do.
“Only join forums where you personally know the people there” is not a scalable solution to this problem.
Respect a diversity of viewpoints and experiences. Your way is not the only way.
NewNewAugustEast@lemmy.zip
on 07 Aug 22:16
collapse
You’re projecting your experiences onto everyone else.
In fairness, you are doing this right now.
I don’t support mandating ID for anything. But you are not the only person in the world. Just because you have no need of it, doesn’t mean no one does. Not everyone uses the internet the same way you do.
You are free to create websites that function this way, or participate in websites that function this way, but don’t push it on the rest of the internet.
“Only join forums where you personally know the people there” is not a scalable solution to this problem.
Sure it is. We didnt all know each other personally when we started, and people are welcome to join anytime. We just can figure out pretty quickly who is real and who is not because we meet each other. So what problem?
Not everyone uses the internet the same way you do.
Of course not, because they are either idiots, or never learned the basics. This is internet 101.
Everyone is a liar.
Everyone is anonymous
Because of rule 2, see rule one.
You are commenting in a privacy forum. I quite likely am talking to a bot, or you are talking to a bot right? So don’t listen to me, BUT: no matter how hard you try, making any system that requires any kind of verification on an internet wide scale WILL be abused.
Use the internet as intended and the problem goes away.
Edit: also, even if you filter the bots, the issues remain because in many ways people are just as bad. Misleading, argumentative, liars, agendas, half truths, etc. So it doesnt really matter.
I didn’t like the age verification law either, but as it would be introduced everywhere, yes or yes, at least it’s mandatory to search an privacy protecting methode, which isn’y not so easy, Because of this I asked Sketchapedia, which shows an zero knowledge system, the service provider only receive an OK or Not OK with it.
Also fuck absolutely every politician who focuses on “supporting” incompetent parents… All this does is to allow them to become even more incompetent and then the government has to do even more parenting…
The EU is the only organization that fairly consistently tries to do the tight thing. Its the only organization from which I regularly hear good news. Just because sometimes they make mid steps doesn’t mean they’re the devil. World wide, it currently is the best we have.
This age verification shit is literallyhappening everywhere, so dunking on the EU for also doing it is disingenuous at best. That they require hardware attestation for that is more a “if you do something, do it well”, so in this case “if you do something stupid, do it very well”
Just to be clear: fuck everything about this, but I’m not so small minded to throw the entire idea of the EU off a cliff just because they do something stupid
Edit: this goes without even talking about how without the EU, Russia would simply start picking off state after state because fuck genocide Putin
The Linux + open source community has more potential to be a historic force than the Eurasian Peninsula, and all first world socialists combined. One will be erased, replaced, the better one consumed and made use of.
threaded - newest
Disgusting
The whole thing is wrongheaded in the first place; any child wanting to access adult-only content will use an adult’s account to do so; any adult attempting to access adult-only content is likewise going to use an adult’s account.
So unless they’re tying this to biometrics that are actually secure against an adverserial child, all the system really does is creates a registry of adults. And we already have those.
I think it’s going up be biometric related
Iirc a portrait photo is a part of the mandatory dataset for the EUDI now
Creating a registry of adults and what content they access is exactly the point of these laws. Always has been. “Protecting children” is just the easiest excuse to make it seem more urgent to violate people’s rights. Just like removing trans healthcare started with children and is now targeting adults.
Thing is, it doesn’t create a registry of what content adults access. Just what content their registered identity accesses.
But in most cases, it is, because most adults are not that technically inclined to get around the logins. Sure there are some tech savvy ones who will bypass it. And maybe a few kids who will use their parents’ accounts rather than just bypassing the logins but it’s still the family accessing the information, but for the majority, it does work as a registry. And though it’s only on a few categories of sites now, the categories inevitably will expand. It’s not just porn, but info on reproductive and gender healthcare, LGBTQ+ dating, and many other subjects that “children must me protected from”, but really they want to know who’s gay, looking for abortions or transgender healthcare or information about whatever other rights their government is trying to force them to give up.
Yes. And perhaps, given time, accessing the wrong version of certain sensitive historic events could even be tracked that way.
It already is. In China if you access information on the Tiananmen Square massacre it has gotten you flagged for ages. In the US, if you access pro-Palastine information or abortion information, these things are then used to prove you are antisemitic or trying to get an abortion where it’s illegal, etc. The easier it is to link that access to an individual through a registry, the more commonly it will be used.
Wasn’t there something about the effectiveness of the Australian law to restrict minors on social media? Ah…
Four in five under-16s in Australia using social media despite ban, study shows
It’s like any controlled substance ban — unless there’s a really invasive crack-down it just shifts the problem to a less safe black market.
Making things easy and safe to access with controls that are adjustable is always more effective than an outright ban that shifts the access fully into unregulated territory.
I think they expect the parent to secure their own account to make sure their child can’t use it. And anyways, it shifts accountability. If the parent lets the child use their account, then the parent takes the blame. If the child gets addicted to social media, that becomes the parent’s fault for giving the child unrestricted access.
Please explain… If I’m below the age of… Whatever they decide, what will or will not be accessible to me? Like, if I’m below a certain age, will some EU appointed DNS restrict what domains I can reach? Or, since this article is about hardware-bound attestation, are my devices going to prevent me from installing and using certain apps if I’m below the age? I don’t understand where the restrictions are going to lie…
Bonus: can’t I just buy, say, five phones right now, root them or install custom OSs before shit hits the fan and be happy?
First of all,
Yes. That’s exactly the question.
The point of the… excitement around this is exactly the uncertainty. We simply don’t know what the EU or national governments of the EU will do with this.
The first problem is that the “hardware bound attestation” isn’t just hardware bound, it’s specifically Apple and Android’s attestation and NOT the more open standard. That means the device that can do this thing, whatever it’s going to be “necessary” for, MUST always be an Apple or Google device, with that bit intact. Tbh, I don’t really know how much rooting affects this, but I would be surprised if it didn’t.
The second problem is that once the infrastructure for blocking access to something and requiring this sort of authentication is in place, it’s just a list of targets. It’s very easy to add another platform, website, app or anything else behind it.
And the reason for this excitement happening now is that the specification that was given for all this to happen previously only said it should be “secure” somehow, but not detailing the “how”. They think they can do it as an implementation detail and pretend it’s not a big deal. So it’s very clearly something those bastards have tried to be sneaky about.
No, whatever the point of their efforts is, they will make sure to not leave obvious loopholes like that open.
Doesn’t sound like an internet worth using
.
The services themselves will probably be made to ask for verification and your devices will answer through the age verification app. Since custom mobile OSs (or desktop Linux) won’t provide hardware attestation, the app won’t work on them and the websites will treat you as underage. The types of services that require age verification aren’t specific, they can change based on EU decisions so eventually people not using “approved” OSs may be locked out of most of the internet.
And you can be damn sure this will infest necessary government services and apps that won’t allow you to contact the government in any other way.
Agree 100%. I hope everyone realizes this! I have seen too many ppl who think, “It’s OK, open source will save us”. But open source can’t. This is a legal and social prob, and needs a legal and social solution.
Oh neat, they broke the Internet, since everything is hosted on Linux…
This wouldn’t impact the backend of these services, the age checking stuff would run on the client, this only breaking Linux (barring android) clients.
The real explanation is that they want control. The children are a excuse.
No because you can go to jail for that, like the dude with his GrapheneOS in the US. They’re probably working on that next.
The fact that children can be deprived of rights with only the vaguest unproven assertion of “safety” is a critical threat to the rights of everyone
no… you can not go to jail, in the EU or the US at least, for having a phone with a custom OS. They are facing charge for using a duress code which wiped their phone. It is very different.
Cool. Have fun trying to enforce it.
even if you are forced to use their stuff for banking, state services and increasingly more?
at best we are looking at having private devices separate from corporate ones. we’d need both devices and services that are ours.
I’m already largely of the opinion this is necessary.
They won’t enforce it on you. They enforce it on the manufactures
So you’ll just have to pay more for an imported laptop that doesn’t have this
You simply outlaw imports of noncompliant hardware. So you’re limited to smugglers. When general computing is outlawed, only outlaws will have general computers.
I mean, we’re already pirates. What is it to add outlaw?
Can’t wait for EU to ban general purpose computing. At some point ,everybody is just going to get a locked down Windows tablet where only EU approved software runs.
They’re gonna ban abacuss next, and then comes mental math, and suddenly 2+2=fish
Can’t wait to become a shady dealer who sells pre 2026 computers with highly illegal software running on it (such as debian)
There’s gonna be a whole black market for smuggling open computing platforms from China 🤣
I fear that is the inevitable whimpered ending of the personal computing era. Cory Doctorow called it back in 2011.
Indeed
Honestly, it’s something where I wonder if we’re doomed to end up there anyway.
I think that the AI companies vastly overstate the usefulness and danger represented by AI models. But the technology is only getting better, and the resources required to run models will decrease over time.
A common scenario brought up are AIs teaching people how to make biological weapons. Can existing LLMs actually do that? I really don’t know. I for one don’t feel like asking copilot, “please give me step-by-step instructions for obtaining and weaponizing anthrax, in steps simple enough someone with only a general science and engineering background can do.” I’m curious what copilot would say. But I won’t be asking copilot that, not because I’m incurious, but because I don’t feel like getting my house raided by the FBI.
But imagine a world where that actually is possible. Forget the claims of Sam Altman. Let’s look 50 years ahead in the future. Imagine being able to ask that question to an open-weight/model LLM, something you can run unmonitored on a home desktop, and actually getting a correct response. Imagine being able to ask endless follow-up questions. A good enough LLM could conceivably walk someone with only a high school education through all the steps needed to create weaponized anthrax from scratch.
Anthrax is something we actually can’t control the spread of. It occurs naturally in the soil and water in some specific locations and conditions. A sufficiently skilled biochemist could go out, collect it, and culture it. And having an LLM capable of giving you step-by-step instructions, dumbed down to whatever your skill level is? Able to coach you through it, perhaps even watch you do it and offer real-time feedback? If you just have to act as the hands of the LLM? Suddenly anyone can weaponize anthrax.
I don’t think existing LLMs are there yet. But what do we actually do if we reach a point where open-source LLMs are? What are we supposed to do when the knowledge to produce weapons of mass destruction becomes cheap and accessible?
A general trend in technology over time is that it has magnified the potential destructive power of a single individual. How can a society survive when anybody has the ability to kill everybody? I just don’t see how you keep society going except by locking down the tech. Maybe require a license for any computer over a certain power. And such computers are heavily surveilled. So you can have a free and private computer, but only if that computer does not make you a danger to everyone around you.
I just don’t know how else a civilization can survive the democratization of weapons of mass destruction.
As much as I’m a privacy guy, those are legit concerns IMO. IDK where the future goes, but I see reasons to worry.
TBH I’m more worried about the overall infopocalypse that’s already in progress. But I also can’t rule out an AI teaching somebody unhinged how to make a devastating biological weapon. Something only accessible in the past to very highly trained ppl, who were not gonna do that.
But I also want my privacy! And I believe privacy is essential to a functional democracy. Feels like every choice is a bad choice.
Yeah, that’s why in an ideal case, I could see a two-tier model developing. Similar to how we handle weapons today. At least in the US, handguns and rifles are pretty obtainable. But anything more than that is heavily restricted. Even 2nd Amendment folks don’t advocate for the private ownership of heavy artillery, FPV suicide drones, armed tanks, etc. We allow anyone to own the things that, while still dangerous, don’t give you the power to kill absurd numbers of people. Even with an AR-15, you’re only taking out so many people before you’re taken down. You’re not a danger to civilization by owning an AR-15.
Computers could work the same way. As AI technology improves, we’ll get a better understanding of the minimum level of compute needed to be dangerous. You then set a limit for unlicensed computing below that level. Unlicensed? Have all the privacy you want. This lets you play games and create text, video, and most any form of expression you want. If your creative medium is as an artist of fully immersive 4K virtual reality worlds, you might have some trouble. But pretty much anything you currently use a computer for would fall under the unlicensed compute threshold.
Above this threshold? Everything is locked down. Everything is logged. Everything is scanned. You’re using a tool that is as dangerous as a pile of plutonium, and we treat it with an appropriate level of respect. Dealing with this privacy violation is just a price you have to pay if you want to use these tools.
IDK, I’m less sold on your proposed solution, than on your proposed problem existing. :)
so bye anything that isn’t microsoft, apple or google? really tech independent of europe.
m.youtube.com/watch?v=ZI51q-_kVG0
.
So there’s a chance that GrapheneOS will be supported. I mean, we can still decompile the app, modify it and then repackage it. Or someone will make a patcher app.
I think the when available part is key.
I would expect it must be open source, so I don’t known why you’d decompile it
github.com/…/av-app-android-wallet-ui
Because some member states argue that their implementation is better when proprietary. Also if you’ll want to build the app yourself, you’ll need the required certs.
Unfortunately not, the wallet app must have source code available except for parts deemed too sensitive, which are exempt
I would love to be wrong about this, but I don’t think it’s likely. Why would a government voluntarily spend money on making the app work for a minority of people running a privacy OS that politicians associate with criminals and gangsters?
Also, it’s not like the wallet app will actually be open source in the traditional sense where you can fork and compile it yourself, so I think getting any decent version of it seems like a long shot
How I see it, ocurres when the laws are made by ancients which confuse an remote control with an smartphone.
<img alt="" src="https://lemmy.ml/pictrs/image/621cd8d1-8612-4c7d-964e-82e21f16963b.png">
Gee. I totally not saw that coming.
These people who push for it are fascists, and the only way to deal with fascists is to kill them before they murder you.
bingo bango
I have a solution to the age verification problem. There is a way to affirmatively prove someone is a real human adult without invasions of privacy. We can use the same ID verification system we’ve been using for centuries: public notaries.
Governments could hand anonymous cryptographic tokens to notaries. These contain no information on the individual. They’re simply a unique cryptographic token. You can go to a notary, pay a nominal fee, show your ID, and grab one of the tokens (possibly just a code printed on a card) from a large bin of them. You can then use this token to register for any number of sites. The notary themselves does not need to note which cryptographic token you grab. The notary doesn’t even know what token you received. The goal is merely to prove you’re an adult human, not to create a cryptographic key tied to your specific identity.
I would then let people do this as many times as they want. You can get a hundred such IDs. They wouldn’t cost much, a few dollar or Euros. This would be no barrier to individuals accessing the net, but it would make them unsuitable for mass spamming.
It’s a legit idea, and there’s a thing like that, called Zero Knowledge Proofs (ZKP).
IMO it’s possible in theory. Like set up and managed in good faith, it can work mathematically, and you can prove it does.
My worry tho is that it wouldn’t be in good faith. It’ll be corrupted somehow. Or it turns out that enough other signals leak that it isn’t very effective. Like fingerprinting and stylometry and w/e allow ID’ing despite the ZKP layer.
Maybe I missed something, but with your proposed solution, what would stop someone from just handing the adult cryptographic token to a kid? It sounds like it would be a similar situation to or even easier to do than fake ID cards or adults buying alcohol for underage people.
Nothing. Who says a solution has to be perfect? If “good enough” is good enough for handling the sale of alcohol, it can certainly be good enough for accessing web sites. No solution to any problem is perfect. You always have to find a balance between preventing the thing you want to stop and the negative effects of your efforts to prevent that thing.
In that case, I suppose I agree with your solution.
It’s not as good as the solution for alcohol as one bottle of beer making it to a child gets used up after only giving one child one drink. Once a token leaks, it can be shared again and again and used by arbitrarily many children arbitrarily many times until someone notices that it’s leaked and revokes it (which then means that websites need to actively update a list of revoked tokens instead of just relying on public key cryptography to confirm it was signed by one of a few authorities, or all tokens will need to expire automatically after a short time).
That will always be the case for online age verification. There’s nothing preventing an adult from signing up for an account and then just giving the account to a kid. This is true no matter the verification method chosen. Unless you’re going to demand people scan their face every time they log in, and even then there are ways around it.
My goal is not to create a perfect solution. My goal is to create a good-enough solution that is as reliable as face or ID scanning, but without the privacy violations.
And face/id scanning aren’t as good as the solution that works in the real world for alcohol because they can be tricked by a video game face or a photo of someone else’s real ID. Any solution that works online can either be trivially bypassed or adds an unacceptable level of hassle and risk (e.g. leaks being used for blackmail) for legitimate users.
The solution for alcohol works really well because very few children have the ability to get a fake ID or convince people it’s real and theirs until they’re close enough to legal age that it doesn’t really matter much if they drink, and parents have the ability to override it on a per-drink basis if they’re okay with children drinking under their supervision, while non-parents can only operate on a very small scale before they risk getting caught. Once people are old enough that they’re obviously adults, they don’t get asked for ID anymore, so it’s only a small fraction of the population that have to deal with any hassle, and a shopkeeper can’t memorise every single ID card they’ve ever seen and then suffer a cyberattack and reveal what alcohol specific people have bought to someone who’ll threaten all of them in case some of them are willing to pay to have it kept secret.
Preserving privacy means tokens become trivial to share, and then there’s nothing stopping a ten year old watching huge amounts of extreme porn except for things that would have worked without having any system, like having their parent stand behind them. If the new system doesn’t improve things compared to having no system, then there’s no point making it.
It would only work if the law mandated that this token cannot be stored or tracked across the web.
I think the idea is that you can use different tokens for each thing.
Right but people won’t and if you do they can still track you by combining other metadata
No. There is zero need for this shit, don’t normalize it.___
There is a clear need for it. There’s value in having online discussion spaces that aren’t just swamped with bots. We really need a reliable way of telling human from bot. I want to find a way to do that preserves privacy to the greatest degree possible.
Do you have any constructive criticism to offer? Maybe a suggested improvement, or an alternative way to accomplish the same goal? What’s your solution to separate human from bot?
There is no need for it. Sorry. Certainly not government mandated, which is the worst part.
Frankly if you treat the internet like was did all the way back in bbs days, it doesn’t matter that much: Everyone is a liar. So I don’t care what anyone says. Bot or not.
In the forums I run we haven’t seen much of a bot presence at all, so these spaces already exist. How do I know? We have all met each other at one point or another. So I may know a, a knows b, and so on.
Do I want the burden of starting authentication on top of this? No.
I don’t want the internet to require me to get authentication. I really don’t care about the bot issue. Go outside and meet people in real life if that’s what you want.
YOU have no need of it. You’re projecting your experiences onto everyone else. Maybe you’re content only hanging out in limited forums where you have to know someone to join. And those forums can continue to operate without any human verification. If you don’t care whether the spaces you occupy are infested with bots, or can manage with white lists, fine. But most people don’t want to talk to bots. Not everyone has the social connections you do.
I don’t support mandating ID for anything. But you are not the only person in the world. Just because you have no need of it, doesn’t mean no one does. Not everyone uses the internet the same way you do.
“Only join forums where you personally know the people there” is not a scalable solution to this problem.
Respect a diversity of viewpoints and experiences. Your way is not the only way.
In fairness, you are doing this right now.
You are free to create websites that function this way, or participate in websites that function this way, but don’t push it on the rest of the internet.
Sure it is. We didnt all know each other personally when we started, and people are welcome to join anytime. We just can figure out pretty quickly who is real and who is not because we meet each other. So what problem?
Of course not, because they are either idiots, or never learned the basics. This is internet 101.
You are commenting in a privacy forum. I quite likely am talking to a bot, or you are talking to a bot right? So don’t listen to me, BUT: no matter how hard you try, making any system that requires any kind of verification on an internet wide scale WILL be abused.
Use the internet as intended and the problem goes away.
Edit: also, even if you filter the bots, the issues remain because in many ways people are just as bad. Misleading, argumentative, liars, agendas, half truths, etc. So it doesnt really matter.
I didn’t like the age verification law either, but as it would be introduced everywhere, yes or yes, at least it’s mandatory to search an privacy protecting methode, which isn’y not so easy, Because of this I asked Sketchapedia, which shows an zero knowledge system, the service provider only receive an OK or Not OK with it.
<img alt="" src="https://lemmy.ml/pictrs/image/3344aa7f-6e61-4d80-ba39-47b44ae828ab.png">
In problems which I can’t avoid, I always prefer to search solutions or at least workarrounds to fix it.
It’s all silly because computers are not paired with any specific body. You could toss your “18+ accessible phone” to your kid, etc.
Unless they do implants, which is nightmare land because we know they’ll want more than just your birthday.
Fuck EU.
Also fuck absolutely every politician who focuses on “supporting” incompetent parents… All this does is to allow them to become even more incompetent and then the government has to do even more parenting…
Well, in that case, fuck you too.
The EU is the only organization that fairly consistently tries to do the tight thing. Its the only organization from which I regularly hear good news. Just because sometimes they make mid steps doesn’t mean they’re the devil. World wide, it currently is the best we have.
This age verification shit is literallyhappening everywhere, so dunking on the EU for also doing it is disingenuous at best. That they require hardware attestation for that is more a “if you do something, do it well”, so in this case “if you do something stupid, do it very well”
Just to be clear: fuck everything about this, but I’m not so small minded to throw the entire idea of the EU off a cliff just because they do something stupid
Edit: this goes without even talking about how without the EU, Russia would simply start picking off state after state because fuck genocide Putin
The Linux + open source community has more potential to be a historic force than the Eurasian Peninsula, and all first world socialists combined. One will be erased, replaced, the better one consumed and made use of.
I am not joking btw
Just being ever so slightly delusional if you think that developers are the same as the EU