Wouldnt it be enough to verify through IMEI to make sure the OS isnt emulated?
Comment on EU age verification app to ban any Android system not licensed by Google
artyom@piefed.social 3 days ago
Please don't link to Reddit. Context below:
The EU is currently developing a whitelabel app to perform privacy-preserving (at least in theory) age verification to be adopted and personalized in the coming months by member states. The app is open source and available here: <https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui>.
Problem is, the app is planning to include remote attestation feature to verify the integrity of the app: <https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui?tab=readme-ov-file#disclaimer>. This is supposed to provide assurance to the age verification service that the app being used is authentic and running on a genuine operating system. Genuine in the case of Android means:
The operating system was licensed by Google
The app was downloaded from the Play Store (thus requiring a Google account)
Device security checks have passed
While there is value to verify device security, this strongly ties the app to many Google properties and services, because those checks won't pass on an aftermarket Android OS, even those which increase security significantly like GrapheneOS, because the app plans to use Google "Play Integrity", which only allows Google licensed systems instead of the standard Android attestation feature to verify systems.
This also means that even though you can compile the app, you won't be able to use it, because it won't come from the Play Store and thus the age verification service will reject it.
The issue has been raised here <https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/issues/10> but no response from team members as of now.
All credit for the original post goes to /u/CreepyZookeepergame4. Link to the original post: https://reddit.com/r/BuyFromEU/comments/1mah79o/eu_age_verification_app_to_ban_any_android_system/
Appoxo@lemmy.dbzer0.com 2 days ago
artyom@piefed.social 2 days ago
IMEI is PII
Appoxo@lemmy.dbzer0.com 2 days ago
Is it tied to my real identity?
If not it seems to me that it should be sufficient as to serve as a security this phone is legit and not emulated/compromised.artyom@piefed.social 2 days ago
Yes it's tied to your identity. It's also not tied at all to your OS.
Redjard@lemmy.dbzer0.com 2 days ago
In the eu, phone numbers by law are tied to state identities.
And the phone provider can naturally resolve their sim IDs down to the phone number they are assigned to.
Anything related to celltower interactions is PII.
dubyakay@lemmy.ca 2 days ago
So is there a way to apply pressure on the EU to think this through first? Surely they could have different ways that doesn’t lock them in to google services.
artyom@piefed.social 2 days ago
According to the users in that issue, the mere application of the API is illegal, as is the dependency. Sooo I dunno what kind of PACs there are in the EU but I would be leaning on and contributing to those.
ggtdbz@lemmy.dbzer0.com 2 days ago
I do feel like that’s a precarious state to leave this in, especially if they’re developing the backend for it.
Is there even enough momentum for a SKG-style wave of coverage? It would need to be justified properly by citing things like the Tea app data leak, to make a strong case (to political pencil pushers) for the danger of tying personal information to profiles or even to platforms. Otherwise the only thing they’ll see is “gamers want to make porn accessible to children”.
I don’t know. This whole situation boils my blood because I really care about online anonymity, and this is kind of nightmare scenario shit for me. I’m not even in the UK or EU.
Ulrich@feddit.org 2 days ago
We’ve had this shit in the US for a while now.
iii@mander.xyz 2 days ago
To avoid people from simply copying the “age proof” and having others reuse it, a nonce/private key combo is needed. To protect that key a DRM style locked down device is necessary.
Seeing the EU doesn’t make any popular hardware, their plan will always rely on either chinese of US manufacturers.
Redjard@lemmy.dbzer0.com 2 days ago
If it is about hiding some data handled by the app, that will be instantly extracted.
There are plenty of people with full integrity on rooted phones. It’s really annoying to set up and keep going, and requiring that would fuck over most rooted phone/custom os users, but someone to fully inspect and leak everything about the app will always be popping up.
iii@mander.xyz 1 day ago
Look at the design of DRM chips. They bake the key into hardware. Some keys have been leaked, I think playstation 2 is an example, but typically by a source inside the company.
General_Effort@lemmy.world 2 days ago
The key doesn’t have to be on your phone. You can just send it to some service to sign it, identifying yourself to that service in whatever way.
iii@mander.xyz 1 day ago
That merely shifts the problem: now the login to that 3rd party can be shared, and age verification subverted.