The key doesn’t have to be on your phone. You can just send it to some service to sign it, identifying yourself to that service in whatever way.
Comment on EU age verification app to ban any Android system not licensed by Google
iii@mander.xyz 1 day agoTo avoid people from simply copying the “age proof” and having others reuse it, a nonce/private key combo is needed. To protect that key a DRM style locked down device is necessary.
Seeing the EU doesn’t make any popular hardware, their plan will always rely on either chinese of US manufacturers.
General_Effort@lemmy.world 1 day ago
iii@mander.xyz 5 hours ago
That merely shifts the problem: now the login to that 3rd party can be shared, and age verification subverted.
General_Effort@lemmy.world 4 hours ago
A phone can also be shared. If it happens at scale, it will be flagged pretty quickly. It’s not a real problem.
The only real problem is the very intention of such laws.
iii@mander.xyz 2 hours ago
If it happens at scale, it will be flagged pretty quickly.
How? In a correct implementation, the 3rd parties only receive proof-of-age, no identity. How will re-use and sharing be detected?
Redjard@lemmy.dbzer0.com 22 hours ago
If it is about hiding some data handled by the app, that will be instantly extracted.
There are plenty of people with full integrity on rooted phones. It’s really annoying to set up and keep going, and requiring that would fuck over most rooted phone/custom os users, but someone to fully inspect and leak everything about the app will always be popping up.
iii@mander.xyz 5 hours ago
Look at the design of DRM chips. They bake the key into hardware. Some keys have been leaked, I think playstation 2 is an example, but typically by a source inside the company.
Redjard@lemmy.dbzer0.com 4 hours ago
That applies to play integrity, and a lot of getting that working is juggling various signatures and keys.
The suggestion above which I replied to was instead about software-managed keys, something handed to the app which it then stores, where the google drm is polled to get that sacred piece of data. Since this is present in the software, it can be plainly read by the user on rooted devices, which hardware-based keys cannot.
Play integrity is hardware based, but the eu app is software based, merely polling googles hardware based stuff somewhere in the process.
iii@mander.xyz 2 hours ago
I understand. In the context of digital sovereignty, even if the linked shitty implementation is discarded (as it should be), every correct implementation will require magic DRM-like chip. This chip will be made by a US or Asian manufacturer, as the EU has no manufacturing.