What’s going on with Europe lately? You all really want GOOGLE of all mega corps in control of your identity?
You’re going the opposite way, it should be your right to install an alternate OS on your phone. If anything they should be banning Google licensed Android.
artyom@piefed.social 1 day ago
Please don't link to Reddit. Context below:
The EU is currently developing a whitelabel app to perform privacy-preserving (at least in theory) age verification to be adopted and personalized in the coming months by member states. The app is open source and available here: <https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui>.
Problem is, the app is planning to include remote attestation feature to verify the integrity of the app: <https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui?tab=readme-ov-file#disclaimer>. This is supposed to provide assurance to the age verification service that the app being used is authentic and running on a genuine operating system. Genuine in the case of Android means:
The operating system was licensed by Google
The app was downloaded from the Play Store (thus requiring a Google account)
Device security checks have passed
While there is value to verify device security, this strongly ties the app to many Google properties and services, because those checks won't pass on an aftermarket Android OS, even those which increase security significantly like GrapheneOS, because the app plans to use Google "Play Integrity", which only allows Google licensed systems instead of the standard Android attestation feature to verify systems.
This also means that even though you can compile the app, you won't be able to use it, because it won't come from the Play Store and thus the age verification service will reject it.
The issue has been raised here <https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/issues/10> but no response from team members as of now.
All credit for the original post goes to /u/CreepyZookeepergame4. Link to the original post: https://reddit.com/r/BuyFromEU/comments/1mah79o/eu_age_verification_app_to_ban_any_android_system/
dubyakay@lemmy.ca 1 day ago
So is there a way to apply pressure on the EU to think this through first? Surely they could have different ways that doesn’t lock them in to google services.
artyom@piefed.social 1 day ago
According to the users in that issue, the mere application of the API is illegal, as is the dependency. Sooo I dunno what kind of PACs there are in the EU but I would be leaning on and contributing to those.
iii@mander.xyz 23 hours ago
To avoid people from simply copying the “age proof” and having others reuse it, a nonce/private key combo is needed. To protect that key a DRM style locked down device is necessary.
Seeing the EU doesn’t make any popular hardware, their plan will always rely on either chinese of US manufacturers.
Appoxo@lemmy.dbzer0.com 1 day ago
Wouldnt it be enough to verify through IMEI to make sure the OS isnt emulated?
artyom@piefed.social 23 hours ago
IMEI is PII