Rendered at 05:21:50 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
jeroenhd 2 days ago [-]
It's not a trojan horse, it's spelled out in the decision, debates, and legal texts to be the explicit goal. The age verification requirement was picked both as a means to prove the technology is sound and as a simple starting point for a full digital ID solution.
The EU already has some form of digital ID in fact, every government provides some kind of OIDC-like service tied to either smart cards or accounts that authenticate the user against a government. The digital wallet solution is an extension to that system that will allow foreign EU citizens to authenticate themselves more easily (eIDAS 2 already implemented an OIDC-like solution but implementation isn't automatic) as well as offer to store the (often mandatory to carry) ID on your phone.
The "what if you buy alcohol for your kids" sscenario of somone giving someone else their age verification tokens is tired and nonsensical. You can already do that in the real world. We accept that risk and, depending on the country, make it a crime in case they do catch you. It hasn't made liquor stores send someone along to see you drink your booze or watch you enjoy your porn mag.
pzo 2 days ago [-]
The difference you barely have to show you physical ID - mostly only when interacting with bank, signing document, government. I never got asked when buying alcohol and if asked at least I would only let to have a look instead of snapping a picture.
Imagine if suddenly every grocery, pharmacy, petrol station, parking place, restaurant, bar etc. now would ask you for your ID AND would snap a picture and store in their database - you wouldn't be happy about it.
vladvasiliu 2 days ago [-]
It's pretty common to have to show some form of state-issued ID when entering bars and the like in France if the bouncer thinks you're underage. Ditto for buying alcohol. Hell, in the US I've had to go back to the hotel to grab my passport to enter a bar. My French driver's license and balding head weren't enough.
But you do have a point about "storing the picture". I think that's why it's very important for whatever solution is chosen to be something that proves you're old enough without saying who you are.
And if you want an example of who has the power these days, I've encountered airport shops that are "take it leave it" (WHSmith in Spain in fact). I was told they can't require my boarding pass, but they won't sell me anything without it... (There was no language barrier)
rightbyte 1 days ago [-]
Isn't that a tax thing on airports? I don't think it is the same problem.
mambru 21 hours ago [-]
That's not now it works.
At least in my country, the ID app lets you generate 3 levels of QR:
Level 1: Just age (also shows a photo on the screen). This is what you would typically use to go in a club or buy alcohol.
Level 2: Adds Full name, birth date, validity date.
Level 3: All the data you can see on the physical ID card.
jeroenhd 2 days ago [-]
Why would they? The only reasons to show ID I can think of is when watching porn or maybe when buying alcohol online, though I doubt stores will want to risk driving customers away with that.
dwedge 2 days ago [-]
Or using social media, signing up for any account where you can post content, and soon creating an account on your own device.
As for why would they, the same reason there are hundreds of tracking cookies on every site.
pmlnr 2 days ago [-]
The same social media that stores everything down to your keystrokes? Sure, the problem is needing a gov ID, sure.
dwedge 2 days ago [-]
Self aware wolf. You don't see the problem with associating that level of tracking with your gov id?
throwthrowuknow 2 days ago [-]
Consider that stores create reward point systems specifically for the purpose of connecting a customer profile to purchases.
oe 1 days ago [-]
Yeah, the bigger chain stores already have most of this information. I don’t know if tying it to an actual ID would make much difference.
rglullis 2 days ago [-]
Yeah, imagine if every convenience store had CCTV security filming everyone 24/7.
Oh, wait...
pzo 2 days ago [-]
they don't know necessary who are you and what are you buying. I don't think also for big shops with many customers that techonology and reliably do instance segmentation - this is not face id.
rglullis 2 days ago [-]
They don't, but there is a significant chance that their "security solution" uploads all the data to a cloud provider (Amazon, Google, Oracle) which will be more than happy to analyze the data for them.
jonathanstrange 2 days ago [-]
That's possible but would be completely and highly illegal, the EU regularly fines companies violating GDPR, and those fines are not trivial at all, they can be quite hefty.
rglullis 2 days ago [-]
I was talking about the reality of the US, but even if I was talking about Europe: how does the GDPR even enter this equation here? I was never asked for consent to have my face recorded when I get into a shop in Germany. Were you?
ragall 2 days ago [-]
Security recordings fall into the category if legitimate need, and have to be deleted after a short while.
rglullis 2 days ago [-]
How is that enforced?
carlos22 2 days ago [-]
Its not. Especially when using US Cloud services. And people do that. Hell even government run schools us GDRP-violating software and force the students to BUY them. The law is nice, the reality is different...
ragall 1 days ago [-]
It doesn't need to. Those recordings are "radioactive" and can't be used in any legitimate fashion except by intelligence agencies.
rglullis 1 days ago [-]
Plenty of data brokers operating outside of the EU who wouldn't mind the "toxicity" of the data they buy.
ragall 1 days ago [-]
Or, I should say, things are enforced after the fact, through the possibility of criminal charges or civil lawsuits. Enforcement doesn't mean that crime is made impossible, just that there is enough deterrent.
rglullis 1 days ago [-]
Except there isn't enough deterrent.
The big companies are still mining user data, they are just forced to use some extra dark patterns to trick people into compliance. Would-be criminals are not going to stop being criminals because of the threat of fines. And TLAs are not going to wait for due process to acquire access to data legally.
All that GDPR does is give the illusion that people are being protected and CYA for politicians and bureaucrats when asked "what are you doing about evil Zuckerberg?"
ragall 1 days ago [-]
You're veering way off-course here. This started from "I was never asked for consent to have my face recorded when I get into a shop in Germany. Were you?", to which I replied that those recordings are radioactive and nobody's allowed to do anything with them except for intelligence agencies. We're not talking about generic web tracking and dark patterns.
1 days ago [-]
xorcist 1 days ago [-]
Do you not pay for you groceries? Then the store probably has a good idea about your identity. In any case, they payment processor knows exactly who you are, and the store and anyone else who cares can buy this information online, albeit in a slightly obfuscated form.
Unless you live at some place where they still accept cash of course, but the writing is on the wall already.
xethos 1 days ago [-]
Sure - that's saved for Visa or Mastercard to track your purchase history across time
SiempreViernes 2 days ago [-]
Doesn't stop the stores from posting clips of you embarrassing yourself online and your acquaintances giving your name away for clout.
pando85 1 days ago [-]
Age verification today, digital ID tomorrow, mandatory tracking forever. The pattern never changes.
tpm 2 days ago [-]
> The digital wallet solution is an extension to that system that will allow foreign EU citizens to authenticate themselves more easily
Is there a roadmap and/or a timeframe for that? I have a Slovak ID same as the author, when will it be useful for accessing internet services?
jeroenhd 2 days ago [-]
Age verification has taken about three or four years to reach the concept stage, and that's the first stage that will be rolled out.
The legal framework behind all this was released all the way back in 2014 and has been officially adopted ten years later.
Officially, by December 2026, each member state must have at least one official wallet solution available for its citizens.
That said, eIDAS 2.0 also mandated that, as of this year, whatever Slovak digital identity solution has been rolled out so far must also work in other member states. In my experience, different governments adopt different foreign identity services at different paces, most of them seemingly missing the deadline.
Banks and other private institutions permitted to ask for ID are supposed to accept the wallet solutions by late 2027.
I expect deadlines to be missed given we've barely gotten the age verification PoC done, but with the groundwork laid out, things might just work out.
tpm 17 hours ago [-]
> I expect deadlines to be missed
My experience working on software for the German public sector sadly agrees with this assesment. Let's hope at least eventually something will work.
broken-kebab 2 days ago [-]
>You can already do that in the real world.
This argument stays on the sand of inadequate analogy. The way that flaw is described in the story it allows industrialization of bypassing the feature. It's huge difference with the "real world".
phatfish 2 days ago [-]
The article is actually one of the better ones I've read. The technical analysis is somewhat above my head, but appears reasonable, and it is suggesting solutions in some cases rather than just dismissing the concerns of parents, and going full privacy nut about our democratically elected governments.
All i would say is that the solution doesn't need to be 100% effective. The same as real world "age gates" or ID verification (which is just some random person looking at your ID in most cases) are not.
The precedent set -- that everything online should NOT be immediately accessible to children -- provides parents (the ones that care at least) with some backup when trying to raise their children. Ultimately society as a whole is responsible children, and i don't want to live in a society that thinks it is fine for kids to scroll any content on social media and watch porn as soon as they are able to work out how to use a smartphone.
The replay attack mentioned may always be a loophole, I'm not sure. But any site hosting the replay attacks should be targeted for shutdown/blocking. The "source" ID must come from somewhere as well, so that could be a route to shutting them down (there are 100's of age verification requests against one ID each day, that's a bit weird...).
If parents are helping their kids bypass age gates or straight up don't care their 11 year old is watching porn, then there is not much to be done in that case. The key thing should be keeping the majority of children in compliance to give cover to the parents that do care. Not giving all the power to bad parents and social media companies as is the situation the moment.
jeroenhd 2 days ago [-]
And unlike in the real world, there's little to no real benefit to it online.
What value is there to industrializing any of this? Kids who will pay someone for their age tokens to watch porn or create social media would probably be smart enough to download a free VPN instead.
Even in the very worst case scenario for the designers of this system, where large amounts of people manage to extract their tokens and hand them out for free, the downsides everyone fears won't apply anymore. I think a lot of people might be happy about that.
dwedge 2 days ago [-]
This "they'll just use a vpn" argument is infuriating to me because it's being used to downplay intrusive laws and make them more palatable. The obvious next step (the UK already hinted at it after the online safety act) is forcing VPNs to do ID verification.
knollimar 2 days ago [-]
if anything, the "they'll just use a vpn" is an argument for the other way.
Law has privacy downsides and is trivially bypassable -> law is bad.
throw-the-towel 1 days ago [-]
And then, blocking the VPNs that don't comply, Russia style. (If you're sure It Can't Happen Here,[0] you're part of the problem.)
I'm not sure I understand your last para. Care to elaborate?
bootsmann 2 days ago [-]
> Real cryptographic unlinkability schemes like BBS+ or CL signatures would produce uncorrelated proofs even on reuse. This is not that.
This discussion was already led ad nauseam with the Swiss eID proposal (which is supposed to be EUID compatible) and the reason why the system relies on rotating signatures instead of ZKPs is that the cryptography hardware modules in most phones don't support algorithms such as BBS+. This creates a tradeoff where the states would have to essentially roll their own crypto storage and bank on this being safer than simply rotating through batches of signatures generated by the hardware cryptography modules (which is largely unproblematic in the grand scheme of things). The major advantage of using the hardware module is that it makes it much harder for attackers to extract the actual secret should the device ever fall into someone else's hands, something that happens to phones from time to time.
Overall, as with every digital ID thread, it would help if some of the fearmon gering commentators would read the actually EUDI specs for once in their lives as it already addresses most of the concerns copy-pasted into these threads
https://eudi.dev/1.6.0/architecture-and-reference-framework-....
fauigerzigerk 2 days ago [-]
Have you read the spec? I have, but I don't understand how the revocation flow is supposed to be safe against collusion between issuers/governments and site owners to reveal the identity of (age verified) users.
bootsmann 2 days ago [-]
Can you model the flow of the attack you want to mount here?
Is it the following:
Issuer revokes the wallet of Alice and then publicly says “This ID is Alice btw” and then verifiers can check their lists to see whether any of their received signatures are revoked (in which case they must be Alice)
fauigerzigerk 2 days ago [-]
The EU's own experts have modeled it. At least that's my understanding of what they are saying in their "Privacy risks and mitigation" document [1].
Section 5 mentions that this issue could be mitigated at some point in the future by using ZKPs, but here's what they're saying about the status of this ZKP integration:
"This topic will be revisited in Topic G to determine the foundational requirements needed for its future integration"
Doesn't sound like this will be implemented any time soon.
I'd very much like to read up on the various proposed ID systems, pros and cons and experience. Do you have a good starting point to recommend beyond "(insert country) eID" on Wikipedia?
raverbashing 2 days ago [-]
> Overall, as with every digital ID thread, it would help if some of the fearmon gering commentators would read the actually EUDI specs for once in their lives
Yeah
I'm getting really really tired of the "crying wolf" crowd
jeroenhd 2 days ago [-]
To be fair to some of them, across the Atlantic the Americans are implementing similar laws in absolutely ridiculous ways.
Many Americans don't even have ID (and plenty of those are reluctant to the general concept of any kind of government ID), let alone any kind of digital ID. However, their governments are pushing frankly weird and absurd ID verification laws to businesses online. Meta seems to be bankrolling lobbying around these laws, so whatever their game is, it's probably very bad for normal people.
If you're coming from a place where the government tells companies they need to set up a system or hire private companies to verify users' ages without providing any kind of official mechanism themselves, leading to ridiculous hacks from cheap and incompetent "age verification" companies, I can understand why the European system seems absurd.
If the US is going to adopt their weird age verification laws, the least they could do is fork the European system already laid out for them. Put a little American flag on it, call it "America First Christian Age Truthness" or whatever the people in charge like, but at least keep the basic privacy properties intact.
SoftTalker 2 days ago [-]
> Many Americans don't even have ID
I don't believe this. "Many" perhaps in raw out-of-context numbers but as a percentage of the population, very few functioning, self-supporting and employed adults in America do not have an ID. It's simply not possible to participate in society without one. You need an ID to register a car, to drive, to vote, to bank, to get a job, to buy a house, to rent an apartment, to get water, power, gas, internet....
If you don't have an ID, you are either a child, or you are deliberately trying to exist off the record. I.e. you are here illegally or you have chosen some very fringe antisocial survivalist offgrid way of living.
tzs 1 days ago [-]
> It's simply not possible to participate in society without one. You need an ID to register a car, to drive, to vote, to bank, to get a job, to buy a house, to rent an apartment, to get water, power, gas, internet....
Around 10% of American adults do not drive.
6% of American adults do not have a bank account (4% for whites and Asians, 11% for Hispanic, and 14% for Black). It is 23% for people with incomes under $25k [1].
About 20% of adult Americans who are not retired do not have a job [1]. Did you forget that some people live with other people and in many of those arrangements only one of them has a job?
Many people have living arrangements where they are not the owner or the renter of record of the place they live. For example many people who live with others as described above.
Approximately 5% of the US economy is cash based and often does not care whether you have any formal ID. Often people who live mostly in the cash economy live in areas with many other such people, which makes it easier.
Relax, it would probably buit by Palantir and operated by Meta /s.
dzhiurgis 1 days ago [-]
You joke, but at least it would work well, be secure and cost appropriate. All at a cost of imaginary privacy that you don’t have already.
aquariusDue 2 days ago [-]
I thought that's what the blue checkmark on X was for already /s
thomasingalls 2 days ago [-]
Just because the government is not out to get you at this exact moment doesn't mean that a future government won't be. Surveillance capacity seems to be a one way ratchet.
bootsmann 2 days ago [-]
What surveillance capacity? In what way does the spec build surveillance capacity?
greenavocado 2 days ago [-]
Mandatory app installation through the mandatory state sanctioned rootkit Google Play store and 4G/5G LTE modems on-chip management engines. And that doesn't even cover the ubiquitous app data partnerships which report your information upstream.
dzhiurgis 1 days ago [-]
97% of population is ok with this
thomasingalls 14 hours ago [-]
Not having a choice is not the same as consent
dzhiurgis 6 hours ago [-]
But you do have a choice. No one is takin away your physical IDs. But vast majority of population is begging for a safe digital ID solution.
Cash is still mostly accepted while majority of transactions are digital.
grey-area 2 days ago [-]
Digital ids are inevitable in my view, just as digital currency has become inescapable because it is more convenient and efficient, these ids will
be issued and things like paper proofs of identity will fall away over time. Physical tokens like bank cards and driving licenses are neither necessary nor a good solution in a networked world.
Our focus therefore should be controlling what governments can do with them - for example disallowing blocking/removing someone’s id, just as we should disallow removing citizenship.
Muromec 2 days ago [-]
I can't help but think people mean something else when they hear "digital ids" then what they are. Like I have a digital id from the government of the Netherlands that I use to log into their government systems to declare taxes or what not. I had an X509 certificate issued by Ukrainian government and have their app to do the same.
It's bad somehow?
jdrek1 2 days ago [-]
The problem is what follows. They will make it mandatory to use the electronic ID to do anything, resulting in total surveillance. And if you happen to land on their "bad" list (which eventually everyone will), you're locked out of life completely. No banking, no traveling, no communication with anyone, no buying food, nothing.
silversmith 2 days ago [-]
In Latvia we've had digital id for close to 20 years. Banks mostly use their own auth, some rely on digital id. No travel service has ever wanted me to use digital id, let alone any other kind of shopping. What we use it for is access to government resources, and signing digital documents. I trust this system WAY more than whatever some company comes up with.
bluebarbet 2 days ago [-]
This is an interesting and hopeful datapoint.
petre 2 days ago [-]
> No travel service has ever wanted me to use digital id, let alone any other kind of shopping
Yup, until they are regulated to do so in case you buy booze, porn, metal detectors, crossbows or who knows what else. And until silversmith tries to dodge the draft but he accidentaly bought some booze woth his gov eID to party with friends.
vrganj 2 days ago [-]
What's stopping anyone from requiring a passport scan right now?
abc123abc123 20 hours ago [-]
No limitations during corona? Remember travelling through your neighbour during corona and was treated worse than a ww2 jew in germany due to not having the authoritarian corona passport.
This is what our every day will be like, when the state has internalized the enormous power of a 100% controlled digital ID. Bye, bye, freedom of thought.
Muromec 7 hours ago [-]
>was treated worse than a ww2 jew in germany due to not having the authoritarian corona passport.
If you were to be treated worse than a jew in ww2 germany, you would not be writing about it here.
silversmith 17 hours ago [-]
You are most likely referring to the EU covid certificate. It functioned as a proof of vaccination or recent negative test, and yeah, that was required for travel at one point. And even then the verification end was `(code: string) -> valid: boolean` function, no personal data was accessible at validation point. It used the digital ID as SSO for accessing your records, so you could save / print the verification code, usually in form of a qr code. I know all this, because I'm friends with people that worked on the Latvian part of the system, and we spent long chat sessions discussing how to best do it in the least privacy-intrusive way.
If you were from outside EU, I fully believe the experience was subpar. 99% or more of verifications went through the EU system, and if you showed up with different kind of documentation, the people tasked with verification "at the edge" might not even know if it was valid form of proof.
Overall, I struggle with being outraged by the concept of digital ID. It's just a digital form of "show me your passport please". We have had physical national ID (mandatory from certain age!) for as long as I can remember myself. The state knows I exist. If a madman gets put in charge, lack of unified digital ID is not going to prevent airport style passport gates being erected around the booze stand.
Muromec 7 hours ago [-]
I think what is happening is a rather philosophical rejection of the mere idea that the government should affect ones life in any way for any reason. Somehow all the laws that existed before are below the baseline, so they kinda fine, but the new things -- those cause outrage.
Then comes this post-hoc rationalization about how it will inevitably be abused, Jews in Nazi Germany, apartheid and chips under the skin.
jcattle 2 days ago [-]
"They" will make it mandatory? Who is they?
How will the current approach result in total surveillance?
I would much prefer hotels would have a scanner which just transmits the bare minimum of identifiable information from the ID instead of it being completely normalized in many countries/hotels that they take your ID card and scan the full thing.
Can you explain to me, how with an eID one would be prevented from communicating with anyone or buying food?
pzo 2 days ago [-]
> Can you explain to me, how with an eID one would be prevented from communicating with anyone or buying food?
Some government (will) make mandatory:
social accounts (so also IM apps like IG, WA, X, messanger), banks, buying simcard, internet, buying alcohol, cigarettes,
energy drinks).
Some companies will make it mandatory implicitly or explicitly just for profit: selling your consumption data, analytics for themselves. E.g. in poland it's harder and harder to pay with cash because reduced stuff and huge queues - they force your use self checking. The pricing changed also that you have to use their loyalty apps if you don't want to be ripped - otherwise you will be paying 50% more.
> I would much prefer hotels would have a scanner which just transmits the bare minimum of identifiable information from the ID instead of it being completely normalized in many countries/hotels that they take your ID card and scan the full thing.
I don't like it either the problem is right now you mostly this being abused only in some hotels. Whats misleading that that this digital id won't allow tracking because you supposed to "trasmitting the bare minimum of identifiable information"
abc123abc123 20 hours ago [-]
Easy. This was done during corona. They have security at the entrace of food stores and scanners. If you do not scan, security will escort you off the premises.
I prefer hotels without ID requirements. There is not a single shred of sound argument why a hotel needs to know who I am. Therefore I often stay in B&B:s without authoritarian ID-controls.
zelphirkalt 20 hours ago [-]
Only that it won't stay at the minimum information. They will want more and more, with some thinly veiled greed for more info.
For example hotels: Some chains may think to advertise using fear mongering, claiming that their hotels are the safest, because they perform background checks based on the information from their customers' ID. You don't want that? Fine! Go elsewhere then! This is private property, if you don't agree to these ToS, you are not allowed to enter or rent rooms, sooo sorry! All you had to do is sign your privacy away here and then let us mine your data ... You don't have anything to hide, do you??
The issue is, that every single involved party from business to government has an incentive to get more data from this system. If there are no laws with guaranteed severe punishments for violations edged into our inalienable human rights and constitutions and those are properly followed up on, in addition to making it technologically impossible to extract more information than necessary, the system sooner or later will be abused.
dwedge 2 days ago [-]
> Can you explain to me, how with an eID one would be prevented from communicating with anyone or buying food?
Why did you only ask about eID and not about "inescapable digital currencies" that was also mentioned in the same paragraph at the top of the thread?
thomasingalls 2 days ago [-]
Are you kidding right now? Have you seen what's happening with ICE in the US? EU countries are just one effective social media campaign cycle away from the same policies. "It can't happen here" is foolish thinking.
See also: CCP
grey-area 23 hours ago [-]
Policies are the problem here, not tools.
dzhiurgis 1 days ago [-]
> Who is they?
You see, the government wants to control the people so they can control the government /s
TeMPOraL 2 days ago [-]
> And if you happen to land on their "bad" list (which eventually everyone will), you're locked out of life completely. No banking, no traveling, no communication with anyone, no buying food, nothing.
Not really. Government is not Big Tech. This happens with accounts of some tech companies precisely because they're private entities setting their own rules in the still wild "wild west" of the Internet. Governments set laws and processes to ensure the things you mentioned do not happen, except in very specific circumstances.
Think of it this way: being "locked out of life completely", resulting in "no banking, no traveling, no communication", etc. is not a new problem. In the off-line world we call that being sanctioned, imprisoned, deprived of personal freedoms, etc. Yes, it happens to some people, but usually for very specific reasons (called "crimes"), after a lengthy bureaucratic process (called "trial" and "sentencing"), with plenty of safeguards to catch and rectify mistakes during and after the fact (like "legal defenses", "appeals", or even "journalists"). It is not something you normally worry about.
Humanity has worked out best practices for these thing over thousands of years of various tribes and nations and governments forming, disbanding, collapsing, emerging, conquering or becoming conquered. Adding electronic IDs on top does not change the nature of the thing. So you won't get locked out of life for posting the wrong emoji in a tax report comment; that would be like being thrown to prison for drawing something on a government form - or rather, if that's even remotely possible in your country, you have much bigger problems than digital IDs, and your best move would be to emigrate somewhere sane before borders close or civil war starts.
Plenty of other things to worry about here (e.g. ID checks suddenly being required by every business, just because it's zero effort to them for some marginal KYC benefit), but getting banned from life due to ToS violation is not one of them.
zelphirkalt 21 hours ago [-]
The worry is not, that tomorrow you will be locked out of life. The worry is, that it will happen gradually, over maybe 20, 30 years.
As always when information exists digitally and can be processed rather easily, there is a strong temptation to misuse it out of its original purpose. As always there is a high risk of information leaking at some point, especially when in the not that capable hands of big organizations and governments.
The worry is also the drift towards disabling people's IDs for even on of the things the GP listed, at some point for any reason. The one with the bank account for example seems not too unlikely. Say at some point they associate financial information with that id. Banks demand insight on this data on grounds of wanting to grant loans only to people with good history. Later on they don't even want to give you a bank account when you ask, because there is no gain in it for them, because your accounts in the past tended to not have a positive balance and maybe at some point you had solvency issues. Try getting a flat to live in without bank account. Try getting a job without bank account.
The point is, that while governments are not big tech, they are also not tiny friendly grandma Emma's village shop. There are still lots of incentives to misuse and mismanage data, while at the same time governments often do not pay competitive salaries as businesses and often attract a certain kind of people working with your data.
Also keep in mind, that so far basically every such system that was implemented in countries like Germany had severe security holes. Just read up on the "elektronische Patientenakte" for example, or the CCC and the initial eID security issues. Trust has been eroded so far, it is at level zero for the government to get such a thing done right.
laughing_man 1 days ago [-]
In both Canada and the US we had people who were "de-banked" in recent years because the government was irritated with them. No trial. No hearing. Just a letter from the bank saying "We don't want your business anymore. Here's a cashier's check with your balance." In Canada at least some of the accounts were actually frozen. "Yes, we have your money, but no you can't have any of it."
In the US there's a requirement for banks to refuse to do business with anyone who would be a "reputational risk". I think it was intended to suppress money laundering. Anyway, when the government calls and says such and such a client represents a reputational risk, the bank doesn't have any choice.
I don't know how it works in other countries, but here in the US you'd be hard pressed to function normally in society without a credit card and bank account.
Zak 2 days ago [-]
Being banned from life due to a TOS violation is a real concern because it's already hard to do a bunch of things without a Google or Apple account. If Google and Apple can require a government ID to create such an account, it becomes very difficult to evade a ban.
Options to get around that problem include regulating Apple and Google or mandating that essential services not require accounts with third-party providers.
ben_w 20 hours ago [-]
> Options to get around that problem include regulating Apple and Google or mandating that essential services not require accounts with third-party providers.
I would call for both of these things, for independent reasons.
All providers who get relied on in this way should need suitable regulation, even for non-essential things like supermarket loyalty cards.
Apple and Google in particular are now too heavily associated with a government hostile to the EU, therefore the EU should as a matter of urgency ensure that essential services do not require them in particular, and the surest way to do so (and make sure no shenanigans happen with mergers) would be to mandate that essential services do not require accounts with any third-party providers. Not even the postal system or a telephone number, you should always have a viable fallback to some physical office which is open at reasonable hours and is in a reasonably accessible location.
SoftTalker 2 days ago [-]
They already do this. KYC, and similar laws. You can't open a bank account in 2026 (at least in the USA) without ID. You can't get credit, open an investment account, buy a house, vote, or be employed without an ID.
A proper digital ID would eliminate a lot of problems we now have with identity theft, having to obsessively protect names, dates of birth, SSNs in our databases (these things were not considered secrets in the pre-internet era).
Yes, we need to be vigilant about freedoms and privacy. But the idea of a government-issued ID that "proves" who you are is not new and I struggle to think of any way identity can be "proven" without a central issuing authority.
laughing_man 1 days ago [-]
A proper digital ID would certainly make things more difficult for thieves, but if someone actually did manage to clone your ID you'd be in a world of hurt, since businesses would start to trust that ID to a greater extent than they trust anything online now.
Muromec 2 days ago [-]
>The problem is what follows
Does it actually follow? It's there for 25 years in some European countries and "everyone" isn't on a government bad list dying of hunger.
betaby 2 days ago [-]
Not sure if that sarcasm or you are serious. But yes, people have issues with access to banking in EU all the time.
Muromec 7 hours ago [-]
I heard stories about banks (mostly the app ones) closing accounts for "no reason" (there is always a reason and it's mostly quite simple), but I haven't heard stories about accounts being refused to be opened or clsoed for not having a digital id. And double so for this happening because the government put them on a list.
The government of course can put you on the list, but they don't need digital id for that. They pass a law, the regulator sends the list to all the banks and boom, you are blocked. I guess we should not have banks or not have the government too.
abc123abc123 20 hours ago [-]
This is the way.
graemep 2 days ago [-]
> just as we should disallow removing citizenship.
However lots of countries do allow removing citizenship In the UK it is a political decision too. Lots of countries allow locking people out of other things (e.g. freezing bank accounts). I therefore doubt we an effectively prevent this.
I do not see the problem with physical tokens. They are simple, do not create a single point of failure (if I lose my phone I still have my cards and cash), robust to network and systems failures. What is the drawback? Having to carry a few cards?
grey-area 2 days ago [-]
Yes and I find this deeply wrong - what politician would you trust with this decision? Debanking is also wrong in my view.
I think we should focus on laws against things like that which lead to tyranny rather than attempting to stop progress.
Cash in particular is expensive to produce/process and no longer honours the promise printed on it, it will be phased out as the transactions with it approach 0%.
Cards are really no different than a token in a phone and don’t work for long either in the absence of a network (both will work offline but do need to be reconciled). I haven’t habitually carried a card in about a decade, I think for similar reasons to cash they will die off by general consensus.
graemep 2 days ago [-]
Cards are significantly different from a token in a phone:
1. They are physically separate. They are not likely to be stolen at the same time as a phone.
2. They do not require battery.
Cash has the same advantages, but even more so as it does not rely on networks at all.
If you only have phones as a means of payment what do you do if you phone is lost, stolen or out of battery? How do you even buy a new phone!?
I think phasing out cash is very short sighted. It is robust and reliable. There is a good reason the Swedish central bank recently recommended that people keep a certain amount of cash at home (1,000 SEK, equivalent to about £80/$108/94 EUR, per adult).
zelphirkalt 20 hours ago [-]
Actually, there is a good point in this: What if I don't want to carry my phone somewhere? I shouldn't be obligated to do so. For example what if I want to go to a demo? Or I simply don't want to be location tracked for an afternoon. There needs to be a non-electronic alternative. I guess we could carry some QR codes with us, that can be scanned by police officers.
wongarsu 2 days ago [-]
The drawback of physical tokens is that you can't use them online. I don't want to spend an hour waiting in queue at the city hall for something I can do online in 10 minutes.
The ideal state is having both physical and digital ID. But that will lead to a slow erosion of the willingness to carry physical ID, even if it stays available (which I believe it will for many decades. Even if national ID cards and drivers licenses were to go digital only, passports won't)
graemep 2 days ago [-]
I use credit cards online all the time. I have logins for government services so I do not need to queue (I had to verify my ID using an app once for one of them). Getting a new driving license (for a change of address) was done online.
pezezin 2 days ago [-]
But you CAN use them online. Smart card readers are nothing new, and quite cheap.
fc417fc802 2 days ago [-]
I think even digital IDs will tend to exist as physical tokens? Also worth noting that you can have a digitized and cryptographically signed ID on "paper" which can serve much the same purpose (security, machine readability) as an electronic one. Where electronic tokens shine (for IDs or otherwise) is attesting to the physical possession of a single copy.
grey-area 2 days ago [-]
I don’t see why they would bother with physical tokens nor would they be popular - things like passports are really quite expensive to manage and largely unecessary these days. An app or identity on people’s phone might be a good stopgap.
However I suspect biometric methods of id verification will render carrying anything redundant long term.
The databases for digital id already exist, they’re just not fully utilised yet and these databases will always be centralised.
mongol 2 days ago [-]
For one thing, it increases resilience in the event of outages. It is a tangible aspect - just like citizens are encouraged to keep cash at home at least in my country (Sweden)
grey-area 2 days ago [-]
Does it though? Our world is now so networked that borders shut down if the network is down - see other responses on this thread.
lodovic 2 days ago [-]
I doubt everyone will still be carrying phones as we know them in a decade, so we might indeed be headed for a future where governments keep giant databases of biometric information. Works OK if you trust your government to handle that properly and not abuse it in the future. The real headache is crossing borders, where your details end up in the hands of a foreign state.
consp 2 days ago [-]
> so we might indeed be headed for a future where governments keep giant databases of biometric information
Don't want to wake you from that nice dream but that ship has sailed quite a while back, at least here in the EU.
LunaSea 2 days ago [-]
Biometrics are usernames at best not passwords.
grey-area 2 days ago [-]
We are already in that future and have been for at least a decade. Passports contain biometrics which are in a central db too.
ACCount37 2 days ago [-]
What? What to replace the phones with? And why whatever replaces them wouldn't be able to do the same things?
b112 2 days ago [-]
I don’t see why they would bother with physical tokens nor would they be popular - things like passports are really quite expensive to manage and largely unecessary these days.
OK. I'll bite. Why are they unnecessary?
Passports have two things. They have information on them, which can be read by looking at them. And they have information on them in chip form, which can be scanned, and is also cryptographically signed by the issuing authority (eg, a government).
To verify a passport you can look at it visually, but you can also scan and validate the info, including photo, in digital form. All you need is the CSCA, the 'country signing certificate' to do so, and there aren't may of those. Small readers exist which are updated with these certs, and so even in the middle of a war zone, with RF jamming, you can verify a country signed what you're looking at.
Relying upon the Internet being there for ID purposes is a massive fail. You'd don't need a networked reachable database to validate that your ID is valid, in a digital way, which can be really helpful with 1M refugees show up at your door during a war, or when the capital city of the issuing nation has been bombed.
You may think this unimportant, but the edge cases are what 99.999% uptime is all about. And the edge cases with ID really need 100% uptime. The last thing you need during a natural disaster is an inability to ... well, do anything.
So even if you have biometric methods to identify someone, you'll also want a local, on person method which has those on chip, and signed by a government saying who you are.
Having ID network connected is also a massive, huge, immense fail. There should be no network connected databases of anything about anyone, in any form. Why? It'll be hacked. This will never, ever, ever change. Never. Paper records can't be hacked en masse, and you can get the same protections by storing records on individual chips with other associated info in paper form.
Dismantling this infrastructure and replacing it with buggy, hackable, online databases just to get digital ID verification is a complete move in the wrong direction. Verifying digitally signed information is not.
And passports can be scanned by phones.
Which means that the info, cryptographically signed, can be verified by anyone in the world too.
Really, what we need is to have everyone chipped, like a pet. Because that's where this ends up, and that's also the only way to always have your ID with you.
As a snarky aside, I've spent my entire life interacting with society all the time, yet only in the last decade has it been necessary to be "carded" constantly to do so. We've literally taken a privacy conscious society, and turned it into a nightmare. I'm identified when I go buy a loaf of bread, the most dystopian, totalitarian government anyone could ever conceive of, is a joke compared to the amount of control and tracking now exercised over people's lives.
So I guess my point is...
If it's annoying and difficult to have to carry around a physical identifier of who you are? And use it regularly?
Why is the solution to make it easier to submit to slavery?
Think that's an over the top statement?
We all know how the US government has pivoted on many things during the current administration. We also know it has had, and continues to have (via private enterprise) a robust degree of information about every fiscal transaction made.
If you look at the McCarthy hearings, they literally went so far as to find documents from decades prior, paper records of course, of people joining socialist clubs in university. Eg, simply sign-in sheets, or their names listed in the minutes of such orgs.
Decades later, that information was used to blacklist careers, destroy lives, not for any proof of malfeasance by those accused, but simply because they were curious in college about socialism.
Those same accused were then used to "name names".
My point is, from the financial data currently being stored about people, anything that makes you stand out in any way could be turned into a problem 10 years down the road. Not to mention, how credit card usage, and digital tracking, and location tracking might hit some pattern.
No one who lived through the McCarthy hearings, just watching them, or lived through how Germany or Russia controlled the lives of their citizens, would ever think any of this increased fingerprint of people is a good idea.
It's all just very dumb. And it will not end well at all.
klausa 2 days ago [-]
This is not how the world already works.
If CBP's systems go down, they will not process (foreign, they'll process US citizens still) arrivals [1], even with physical passports in front of them. I assume the EU ESS works the same.
"If the internet goes down, your border checkpoint is down" is not some terrifying future we need to protect against, it's the reality of the world as you live in right now.
[1]: I've had to wait for an hour, at SFO of all places, because of exactly that happening.
fc417fc802 2 days ago [-]
TBF given that a temporary outage is abnormal it makes a certain amount of sense to default to shutting down. Whereas during an extended outage you can pick back up as long as the key parts of your system are capable of operating without the network.
petu 2 days ago [-]
> Relying upon the Internet being there for ID purposes is a massive fail.
Why would you need internet? Document holder smartphone can cache the document for years and present it over NFC (including photo, signature, etc). Just like existing biometric passports work, but replace the physical passport with smartphone app.
klausa 2 days ago [-]
To check against $your-local-law-enforcement-agency database, $your-local-immigration-agency for history of entry, etc.
The internet requirement is not there for the person presenting the document, it's for the person/system checking it.
petu 2 days ago [-]
System checking it just verifies the signature is valid and thus all data presented is valid? Your browser doesn't need to query any Root CAs to trust SSL certificate, https works without internet.
History of entry and visas/etc could be stored on device as well
klausa 2 days ago [-]
If you want to argue for a theoretical system that is self-contained, only relies on the data that is present on either the physical (or the theoretical cryptographically signed digital) passport, you're free to do that.
But in the real world, the systems that deal with processing people's entries already cross-reference multiple other existing databases, require internet connectivity to do so, and I think you'll have hard time convincing anyone to stop doing that.
fc417fc802 1 days ago [-]
They check opportunistically but they are capable of operating without doing so.
kindkang2024 1 days ago [-]
— There should be no network connected databases of anything about anyone, in any form.
Couldn't agree more. The more we know, the more susceptible we are to bias and division.
izacus 2 days ago [-]
Many EU countries already issue a chipcard IDs which can be used to auth for government services (via NFC or a dedicated reader).
So yeah, I'd expect those to move to a phone as an alternative to the card
shevy-java 2 days ago [-]
This is not the same. For instance, we can access the internet without needing that ID. But right now there are attempts to force a digital ID in order to access information on the www - this is the whole idea behind "age verification". The kids are just used as excuse here. It has never been about the kids.
izacus 2 days ago [-]
I think you're jumping to conclusions that aren't supported by the digital ID proposal.
Even with that: There's plenty of services dangerous to kids that we gate behind an ID check and I don't particularly see why internet is special in any way.
fc417fc802 1 days ago [-]
You think bad actors are going to plainly spell out their nefarious intentions? Or worse, the misinformed reactionaries that genuinely believe they're doing good.
No one claimed the internet should receive special treatment. The two forms of ID check that you're attempting to equate aren't the same.
Muromec 2 days ago [-]
Most passports in post 9/11 world have a chip. Thanks America!
> for example disallowing blocking/removing someone’s id
If I lose my passport I am obliged to call the police so that they revoke it, if I lose my phone with my digital ID on it they also need to be able to revoke that ID.
grey-area 2 days ago [-]
Sure, I meant disabling without replacement, making someone an unperson. Obviously updates and replacements would be required as with passports.
I don’t think governments should be allowed to do that. They do it with passports and I think it’s deeply wrong but also it would be far more damaging and immediate with a digital id (which will inevitably be used for a lot of services) - similar to being refused a bank account.
abc123abc123 20 hours ago [-]
How beautifully naive. When was the last time you controlled the government? This idea, that we just trust the government to be good, and that it listens to the voters needs to die.
The government should always be assumed to be evil, and work towards complete and ultimate power. It is a cancer that spreads.
Therefore decentralization, and a private libertarian society, is the only ethical and long term sustainable society possible. Every other society, eventually collapses into authoritarianism and the burning of the jews.
shevy-java 2 days ago [-]
I don't see it as inevitable at any stage. Why would it be necessary? Why is access to information tied to a digital id suddenly? Also, where is digital currency inscapable? I can not pay with a bank note suddenly?
> Physical tokens like bank cards and driving licenses are neither necessary nor a good solution in a networked world.
I see absolutely nothing wrong with physical tokens. You could reason that this or that has more or fewer advantages but to insinuate that digital is always better, all of the time, is simply wrong.
phillc73 2 days ago [-]
> I can not pay with a bank note suddenly?
In some places you cannot. I was in London post-COVID and there were a bunch of tourist things, like a riverboat on the Thames, where you could only pay with a card. Went to a craft cider bar out in the countryside and again, they didn’t accept cash. Personally, I think businesses should be forced to accept all legal tender, which means cash stays as a first class payment method, but that’s not how it is in many places.
On the other hand, in Austria there are many places that are cash only, especially small restaurants in the countryside or community sporting events with coffee bars.
mayama 2 days ago [-]
With the way elections changed after social media became big. Govts want to have control back, like they did before. And are increasingly curbing open internet with boogeyman CP or terrorists, new fear of mass AI CP. Ultimately we'll get 2nd hand version of great firewall and social credit system. Some "liberal democracies" already have root of such systems implemented.
kivle 2 days ago [-]
I think it has more to do with digital verification for social media in a hope of killing bot accounts that are interfering in the public debate. Some of the biggest social media influencer accounts turns out to be Chinese/Russian bots trying to fuel hate/division our democracies, and with LLMs it is only getting worse. Some form of digital ID to verify social media account identities is probably the only hope left of having a real public debate.
js8 2 days ago [-]
The bot problem is solvable by using a web of trust system. You don't need a digital ID for that (i.e. you don't need to tie your digital world identity to a real world identity, nor you need a central agency to manage these).
In web of trust, anyone could publicly certify who they know is a real person (i.e. validate a link from their id to another id). Then, if you received a message from someone, the system would find the path in the graph of real people you trust, to determine the trustworthiness of the source. So if the account is a bot, there would be no path from it to you in the trust graph.
The advantage is that everyone could supply their own subjective trustworthiness score, altering the graph. They could even publish it, so that other people could use trustworthiness assesment of accounts they personally trust.
The big issue with a system of web of trust is that it is too efficient, and just kills commercial advertising (and also propaganda). Because that is all about overcoming the natural web of trust that humans have.
vaylian 2 days ago [-]
Then the politicians should be honest about this goal. The best way to solve a problem requires understanding what the problem is. If we pretend to solve another problem, the solution for the actual will be less than ideal.
petre 2 days ago [-]
That's actually great for social media companies to create a profile on you and feed you ads. They don't care about the bots or denocracy. The only hope for a real public debate is to show up in person at the debate.
sunaookami 2 days ago [-]
>Some of the biggest social media influencer accounts turns out to be Chinese/Russian bots trying to fuel hate/division our democracies
This is propaganda, none of those supposed networks exists or were successful in anything and when the media do show some supposed accounts they don't have a lot of views. Please stop falling for this, your democracy sucks because the politicians suck and the people want change so they turn to extremist parties.
bootsmann 2 days ago [-]
Yes, obviously, the Romanian supreme court having to overturn and annul a presidential election due to Russian social media inference is entirely made up propaganda.
sunaookami 2 days ago [-]
Romania's courts are corrupt and not independent.
strictnein 2 days ago [-]
> "none of those supposed networks exists"
Countries have been interfering in the internal workings of other countries for centuries, if not millennia. If you want to read up on more recent accounts of this, many of which predate social media, the book Active Measures by Thomas Rid is a good place to start.
Or you can continue to think that this is all just made up "propaganda" and we're all fools, but you alone have seen the light.
chupasaurus 2 days ago [-]
Russian "bot farms" are investigated quite well. Usually they operate in Russian-speaking sides of platforms but sometimes they go "foreign". I agree that impact of those might be exaggerated but it's hard to measure in the first place.
Pooge 2 days ago [-]
> Govts want to have control back
By forcing us to go through devices completely controlled by US companies?
graemep 2 days ago [-]
Yes. Control of information and citizen's behaviour is a higher priority for them than sovereignty.
esperent 2 days ago [-]
What are you referencing here?
green7ea 2 days ago [-]
Many of the proposed EU digital solutions require a Google or Apple verified phone. This makes escaping American companies difficult.
esperent 2 days ago [-]
I don't think that's true, it seems to be just this specific German one:
Via: https://discuss.grapheneos.org/d/24452-eu-might-enforce-goog... which specifically quotes the law that should forbid such approach (Article 6(4) DMA) - so EU initiative and engineers consciously and intentionality breaking EU law in the prototype that is supposed to be replicated later.
2 days ago [-]
Pooge 2 days ago [-]
Switzerland's rely completely on an (Android/iOS) application. No desktop version. If you change your phone you must ask for a new ID.
delusional 2 days ago [-]
I don't know if it has anything to do with changes in elections directly. My government has been talking for a while making the case that social media use makes us dumber, sadder, and more scared. I believe it's true that they also see that playing out in elections, but that's not where they want to solve a problem.
Wouldn't it be strange if solving a problem didn't affect elections?
pjc50 2 days ago [-]
This has been noticeable since Tahrir square; I used to say that Twitter gives you a revolution whether you need it or not.
But it's becoming increasingly clear how badly compromised the whole thing is with fake opinions and enemy propaganda.
I don't like either of the options. I don't like control by the state, and I don't like control by mad billionaires. I don't like the far right cesspool of 4chan, but can't disagree with their position that they shouldn't have to care about OFCOM.
ben_w 23 hours ago [-]
> I don't like the far right cesspool of 4chan, but can't disagree with their position that they shouldn't have to care about OFCOM.
While I agree with this statement, I thought there was some kind of requirement that OFCOM goes through a process like this before being allowed to ask for a domain to be blocked in the UK?
The latter is, I think, something OFCOM should be allowed to do with a restriction that it can only come after other options fail.
pjc50 21 hours ago [-]
Oh, it's much more stupid than that: OFCOM can't block websites, I just checked and it's available on my phone right now. They've issued a fine to 4chan instead. Which they are ignoring.
Imgur have gone the other direction: they have voluntarily blocked the UK (!), which is very irritating when trying to browse Reddit.
There's certainly a process, but not a good one.
(separate from all this, the Internet Watch Foundation maintains a blocklist which ISPs voluntarily follow, of actual CSAM.)
ben_w 20 hours ago [-]
> OFCOM can't block websites, I just checked and it's available on my phone right now.
Until the process is complete, that's not evidence of inability, that's just the process:
Where appropriate, if a provider fails to comply with its safety duties, we can also seek a court order for ‘business disruption measures’, such as requiring payment providers or advertisers to withdraw their services from a platform, or requiring Internet Service Providers to block a site in the UK.
> There's certainly a process, but not a good one.
Indeed. There does seem to be a mutual non-comprehension of how the internet functions amongst lawmakers and enforcers in both the UK and the USA; both seem to act like they have more sovereignty over the internet than is possible without reaching much faster for a block order for sites outside their respective jurisdictions.
coldtea 2 days ago [-]
>My government has been talking for a while making the case that social media use makes us dumber, sadder, and more scared. I believe it's true that they also see that playing out in elections, but that's not where they want to solve a problem.
The governments themselves are "dumber, sadder, and more scared". They are worried because social media puts regular people talking on equal footing to official propagandas (being able to reach everybody else). That's what they fear, because they have the lowest approval ratings and legitimization in over half a century, and they're also making everything shittier and shittier to the benefit of their corporate overlords.
schubidubiduba 2 days ago [-]
You couldn't be more wrong. There's no equal footing when propaganda buys you thousands of bots to parrot what you want on every related post. And there is no ability to "reach everyone" when intransparent algorithms decide what reaches who. Moreover, some kind of content is explicitly suppressed and censored.
coldtea 1 days ago [-]
All of that is still irrelevant if the people can still express themselves. The truth can rise on top of bots.
The problem is the algorithm and the "explicitly suppressed and censored" and that's on the governments and corporations. So that's the worst argument for giving the government more control.
delusional 16 hours ago [-]
> All of that is still irrelevant if the people can still express themselves. The truth can rise on top of bots.
That argument seems easily debunked by pointing at the effectiveness of propaganda, which is in its essence indistinguishable from bots.
zrn900 1 days ago [-]
Statistics showed that bots don't change opinions. The only reason why certain establishments scream about them is to explain their election losses. People have very deep biases, and 'randos' blabbering online does not change them. It doesn't matter whether those 'randos' are bots or are real.
phatfish 2 days ago [-]
I will agree that governments are happy to bend the knee to corporations. But corporations control social media, so why would the corporations themselves not further their agenda using the platforms they control? Be that simply letting chaos ensue (see the UK Southport riots that were sparked by a "news story" from Pakistan) or from tuning the algorithms directly.
People have control over their government, at least in democracies that are functioning to a basic level (see Hungary recently). But they have zero control over social media, in fact the only organisations that can control global billion dollar tech companies are nation state governments...
CalRobert 2 days ago [-]
It could be both
malka1986 2 days ago [-]
they have the lowest approval ratings and legitimization in over half a century, because they're making everything shittier and shittier to the benefit of their corporate overlords.
subscribed 2 days ago [-]
The governments don't mind AI CP even made with real children as long as you're a billionaire openly selling access to the generator.
That kind of serves as a proof to your opinion it's a boogeyman.
petre 2 days ago [-]
They possibly do, which is why France invited Musk to attend a hearing.
*invited to attend a hearing* after they could no longer ignore the fact the guy is openly selling (and previously posting) CSAM based on the real kids?
That would be a very gentle way to express hurt feelings, not the way to treat a guy who knowingly does that.
wolvoleo 2 days ago [-]
> In any case, it was always presented as a toolbox that countries should adapt into their apps – so judging the app by itself does not make much sense, it depends on how these techniques are implemented in each country’s verification app. There will be no single EU app, despite what the honchos of EU say.
Even more reason to make the "demo" app do things correctly because it's very unlikely that all member states actually implement things correctly.
> The internet is scary, parents think they can’t protect their children from many bad things happening, and someone came to provide a “solution."
A simple solution is just not providing your kids with a phone or computer.
Don't forget that many sources of porn will not obey this. Think the pirate bay will ask for age verification? If they obeyed the law they wouldn't even exist.
It's a solution for nothing, as the article points out too.
6r17 2 days ago [-]
Whether there is a single app or not doesn't really matter - i'm more concerned about the database itself and the inter-connectivity between them and most importantly by which control acceptance protocol we abide between states.
The idea that we want a single database or a network without any kind of control is frightening me
delusional 2 days ago [-]
What do you mean by "control" here? It's my understanding that EU law afford citizens the right to correct data that is wrong about them.
choo-t 2 days ago [-]
The problem is not about the data being correct or not, it's about its existence in the first place.
Why would you correct data about you very own surveillance ?
grey-area 2 days ago [-]
Governments need to identify citizens. They currently do this via paper records and extensive digital databases that those tie into. They will in future do this via digital records/tokens but this won’t change much.
Some amount of id verification and surveillance is of course required for a government to function, the question should be more what is allowed and what is not.
delusional 2 days ago [-]
Is all data about you "surveillance". When your doctor produces a medical record after your visit, are they "surveilling" you? How about when the railway company stores your travels to bill you later?
I'll assume your answer is no, and I that case surely you must see the value in that medical record being correct.
choo-t 2 days ago [-]
Are you equaling mass surveillance to a doctor keeping track of your health for diagnostic accuracy purpose ?
Concerning the railway example, they only need to store how much I owe them, not my travels. Storing travel history on their end is already surveillance.
Data keeping purpose and consents are what make something surveillance or not.
Forcing every citizen to use ID to access the web is surveillance plain and simple.
delusional 2 days ago [-]
> Are you equaling mass surveillance to a doctor keeping track of your health for diagnostic accuracy purpose ?
No, I am legitimately asking to clarify your position, hence why I assumed you wouldn't call that surveillance. The point was for us to agree that the right to correct data is a meaningful and useful right to have.
Once we've clarified that, the rest of the arguments comes down on the separation of "surveillance" from "record keeping", a separation you attribute to "Data keeping purposes and consents". That aligns with current EU law, and I largely agree with treating that as a separation point. If you have a valid purpose, either by law or by duty to your customer, you get to keep records necessary to fulfill that need. I would note that these "duty to your customer" clauses are usually pretty broad and would, I imagine, allow the railroad company to keep and process your travel record for fraud prevention purposes.
The issue we encounter is what a valid "data keeping purpose" is, and if we trust our public institutions and infrastructure to govern that question. Especially when the potential data processors is a government agency. This I'm entirely uninterested in debating that question with a rando on HN. We likely live in two very distinct regulatory frameworks and have vastly different local governments. There's no basis for us to agree here.
I would however end by noting that the two clauses of your statement
> Data keeping purpose and consents are what make something surveillance or not.
and
> Forcing every citizen to use ID to access the web is surveillance plain and simple.
Are in tension with one another. Clause 1 opens up for the idea that there exists valid "non-surveillance" record keeping, and that the distinction of such record keeping from surveillance requires determination of consent and purpose. Clause 2 then foregoes that determination and just presupposes the argument. All ID checks are definitionally surveillance irrespective of purpose and consent.
In the current legal framework, government derives it's unilateral consent from the vote. If the law passes in a democratic system then it is, by that very process, a consensual and valid purpose.
choo-t 2 days ago [-]
> Are in tension with one another. Clause 1 opens up for the idea that there exists valid "non-surveillance" record keeping, and that the distinction of such record keeping from surveillance requires determination of consent and purpose. Clause 2 then foregoes that determination and just presupposes the argument.
"Forcing" highlights the lack of consent, the distinction is still present.
> In the current legal framework, government derives it's unilateral consent from the vote. If the law passes in a democratic system, then it is, by that very process, a consensual and valid purpose.
Absolutely not. Being voted in a parliament doesn't mean citizens consented to it.
Simple example: compulsory military enrollment vs voluntary military enrollment. Only one of them derive from consent, even if both derive from a law discussed in parliament.
harvey9 2 days ago [-]
Since you are bringing a semantic argument you might like to know that your doctor does in fact surveil you, hence the term "public health surveillance"
delusional 2 days ago [-]
I have never heard the term "public health surveillance" and it's hypothetical use has no bearing on my argument.
6r17 2 days ago [-]
I mean that there is a big difference between a state automatically providing your data to any other state while having "their database disconnected" - and a human operator in the loop and an administrative verification of the appropriate access ;
For example this would allow a state to refuse access to the PI of their citizens for cases that are not administratively documented. This forces the access audit sufficiently that a malign actor cannot simply request data for a citizen without having probable cause ; another vector we want to protect ourselves against is simply the psycho/sociopaths that have access to these data without surveillance.
hiciu 1 days ago [-]
Whats your source for the database sharing claim?
The way I understand it is more like tls certs, with each country managing their own root cert.
croes 2 days ago [-]
> A simple solution is just not providing your kids with a phone or computer.
That’s not a solution.
Nowadays many schools require access to a computer.
eikenberry 1 days ago [-]
Putting the computer in a common room addresses this case as they have access but the public space adds a level of restraint.
croes 1 days ago [-]
They require access to computers at home because the teachers send the homework per web platform.
Also the class schedule including the substitutes are communicated per smartphone app
rcbdev 2 days ago [-]
These schools, at least here where I am in Europe, have to provide their pupils with devices. How else would it be fair?
wolvoleo 2 days ago [-]
Yes the bigger problem is those schools often provide them with chromebooks with are mass surveilance devices in disguise :'(
isodev 2 days ago [-]
We’ve had eID for a long time and I’m fine with it becoming more prominent online. Same for age verification, once we settle on a way to do it without US/Palantir being involved in the process.
It seems unlikely that a true Zero Knowledge Proof system for things like age verification would ever be allowed.
Also, remote attestation doesn't work that way and for good reason. Under a true ZKP system, a single defector (extracted/leaked/etc key) would be able to generate an infinite number of false attestations without detection.
esperent 2 days ago [-]
> It seems unlikely that a true Zero Knowledge Proof system for things like age verification would ever be allowed
This article is about EU age verification which is specifically and definitely stated as using zero knowledge proof in all technical docs that I've seen:
In that case Google play integrity cannot be used.
It certifies devices running on Oreo (because vendor didn't provide updates),meaning there are almost infinite vulnerabilities that will allow to leak the keys.
1vuio0pswjnm7 1 days ago [-]
May I share a different perspective
"EU Age Control" is not a Trojan Horse. The software (app) does what it purports to do. No one _wants_ to use it
The "Trojan Horse" is the corporate mobile OS. It's a "free gift". People such as the author happily accept it. These people _want_ to use the corporate mobile OS for what they believe it is, which is something other than software to defeat privacy for the benefit of Google, Apple and their advertiser business partners and customers
People don't think of the software as performing that function. Meanwhile it is the core "business model" of its distributor. The corporate mobile OS is a Trojan Horse
This is why the "age verification" app only works when using the corporate mobile OS. The author states:
"The apps will not work unless you have a Google or Apple approved device. Forget Linux, GrapheneOS, Huawei, after-market firmwares. It's part of the security model."
The bogus justification for requesting ID is not "age verification" it is "security". That's the nonsense reason why the computer owner cannot use an OS he/she compiles himself/herself and why people happily accept the Trojan Horse. The corporate mobile OS is an instrument of data collection, surveillance and online advertising but that's not how the author sees it. He does not see what's inside, he sees a beautiful "free gift"
PunchyHamster 2 days ago [-]
Many countries have digital IDs for years now.
It's not for digital IDs. It's for surveillance.
Digital IDs are fine (and desired even) if you are only requiring it for GOVERNMENT (same entity that released them) communication. Push for age control is scheme to make that info available for private companies and that's the trojan horse here.
jeroenhd 2 days ago [-]
> that info
That info being: {"over_18": true} or maybe {"over_16": true, "over_18": false} with a government signature.
Might be a problem if you've got a Vatican ID, I suppose? Though they don't participate in this system of course.
mentalgear 2 days ago [-]
Not a fan, but unfortunately a "digital proof of citizenship" seems to inevitable due to the en-shitification of the internet, autocratic state actor's doctrines to destabilise free societies through disinformation that matches well with social media's en-rage-ment business model, and the more recent AI slopification / AI bots running wild.
The question is whether citizens can build enough pressure for such verification systems to be state-based and truly zero-knowledge (akin to the EU's) versus having the private sector 'verify' each user to siphon data, profit off it (Thiel's Persona) and fortify surveillance-capitalism and autocratic administrations.
phatfish 2 days ago [-]
At the moment in the UK (where any mention of digital ID sends half the population mental) you have to email a whole raft of ID docs and personal data to estate agents, mortgage brokers, solicitors etc. to get an ID check done. Or use a private ID service that can have a cost associated and may not be any more secure than my passport scan sitting in someones M365 mailbox. You can't know.
I'd be happy to have a government service replace all that nonsense, where a one-time challenge code could verify my ID. There is now a UK.gov "One Login" authentication used by other government services that is essentially a digital ID as far as I can see. It just needs to be made mandatory for ID checks by law.
Such a service can also be used for age verification with the correct privacy controls in place, far better than all the dodgy age verification services that exist now.
Digital ID and age verification are going to be a part of the internet going forward. I'd rather have a government service that (in a functioning democracy) has accountability to the citizens that use it. ID verification is also a natural monopoly, so the government picks a winner anyway.
moezd 2 days ago [-]
Internet used to be a cyberpunk escape hatch. Now we want to get rid of any and all anonymity at all costs, to the point of waking your phone up with a face id and your internet history tied to your government ID 1-1. This is just sad.
pveierland 2 days ago [-]
It's frustrating to see how shortsighted and tech-illiterate politicians are on these topics. This article from Norway today presents the attitude of the minister of digitization as simply "Social media companies are making billions and we expect them to adequately implement age verification systems with solutions that respect privacy and we will fine those who fail at doing this".
The fantastic irony is that in some weak attempt to protect against the "evil big tech companies" they directly facilitate increased mass surveillance and removal of individual rights, instead of choosing more scalable and robust answers such as funding and promoting the development of protocols and open standards that can be applied voluntarily and in a decentralized manner to help mitigate these problems.
I have computers side by side on my desktop running Linux, and it is amazing to me how I can call `wormhole send --message hello` and receive it on the machine next to me, knowing that only I can receive this message, without it running through an age approval mechanism, without it being client-side scanned, and without being logged in some government database.
This is the century of AI and robotics - technologies which can facilitate great concentration of power and wealth. Gradually introducing mechanisms that facilitate digital fascism seems like a really bad way to guard us against this.
A decentralized government ID system is a contradiction in terms. Government ID is and must be centralized. For me the decentralization is precisely the problem. I shouldn't end up with my government ID registered in a newspaper's database because I bought a newspaper subscription. Decentralization is not good here. In order for identification to work, decentralization requires that everyone who tangentially has access to your identity has persistent verifiable knowledge of your identity. Even in a centralized system it is hard to avoid this.
Bender 2 days ago [-]
I do not know about others here but I will not be participating in anything that requires ID verification. Such domains will be blocked on my DoH servers both private and public though I doubt many here would want to use something other than Cloudflare DoH.
Anyone else here planning on blocking sites that require age / ID verification? Are there any publicly available domain deny-lists that could be added to uBlock yet?
sunnybeetroot 1 days ago [-]
I guess you can start by blocking every social media website?
Bender 1 days ago [-]
Yes. I think I would block the social media sites that implement Age/ID checks as they implement them.
imrozim 2 days ago [-]
I am 20.idea showing to govt I'd just to browse feels wrong even if the crpto works the habit of verifying Identity everywhere is the real problem.
narennayagam 2 days ago [-]
Interesting point about ZKP systems. The challenge
with age verification is balancing privacy with
enforcement — any centralized solution creates a
honeypot for data breaches.
sublimefire 2 days ago [-]
There are slight contradictions in this open list of complaints with a bit of guesstimates.
As mentioned digital ids are a thing and this is where everything is moving. The author mentions that it would be great to use it but does not believe it is possible and then says age checks will lead to it and it is bad. There are reasons why digital ids will be forced and one of the big ones is because bigtech companies do not want to invest into looking after the content, e.g. misinformation, bullying, etc. Not to mention the inability of companies to control the age of users, and everyone knows this is not in the interest of advertisers.
Criticism is good but it also has to offer some options. Saying everything is bad bad does not help. All in all I have kids and it is very difficult to filter all of their internet traffic and I am not your average parent. Kids are reading crap and get brainwashed everyday, and the idea that you should just let them is ridiculous. Cyber bullying is a thing and I wonder what would you do when your kids get to be on the receiving side.
IMO this is trying to blame politicians who represent their electorate who wants this without acknowledging that the issue is in huge ad funded companies whose interest is to gather all that private data without any supervision or filtering. BTW Data is constantly being leaked from large companies as well, not only gov entities.
In relation to guesstimates the author jumps to possible conclusions without sufficient proof.
What would the author suggest to fix the main issues though?
sunshine-o 2 days ago [-]
In the end the dilemma goes like this for most users:
- If you rely on Big Tech for your identity and data you loose all privacy but can expect some security.
- If you go with your government you still loose your privacy but also all security.
I saw on HN just in the last month that the EU and France got hacked and very sensitive data is now on the Internet.
croes 2 days ago [-]
Where is the big to what we have now?
Not much more freedom, but the control is outside voters reach.
Just ask Nicolas Guillou
snvzz 2 days ago [-]
To understand the age verification push, got to follow the incentives[0].
It's HN, nobody reads articles even when they're not slop.
jonathanstrange 2 days ago [-]
A digital ID not based on EU hardware should be taken down with prejudice. It's a direct threat to national security. US companies and, by extension, US government authorities have control over every popular endpoint (mobile phones, desktop OS).
Besides, if someone wants a digital ID, it already exists in many countries. Phones with NFC chips can read many passports, e.g. Germany has an "electronic passport" since 2005. It's barely used, though, because it's bullshit.
TacticalCoder 2 days ago [-]
How's this going to work now that there are, arguably, already more AI agents online than humans? Or close to it. Most of the web if fake AI slop already. Many websites are more crawled by bots than by real people.
We'll need to apply for digital IDs for bots and AI agents?
shevy-java 2 days ago [-]
> There will be no single EU app, despite what the honchos of EU say.
This shows that the EU commission is systematically lying.
This problem used to exist in the past with Leyen - she is ultimately a lobbyist and that has to stop. Friedrich Merz too by the way - there is a reason why recent polls indicate that the german voters want him out of politics at once.
The EU needs to reform. Right now lobbyists have too much abuse-power. The age sniffing is a great example here - isn't it suspicious how this goes in sync right now in so many countries? Who is paying for this? Nobody needs that, except for some companies.
> Big platforms must verify age for certain content.
But why is their concern, suddenly my concern? I see no need to be in support of any law that would require people to ID in order to access information on the world wide web. That's very obviously the real goal and agenda - everyone with a bit of brains sees this.
> It is the same EU that hates these American corporations and wants EU alternatives for everything
That's not true. The EU commission I consider a lobbyist group, for instance. They lie and lie and lie.
Nothing will seriously changed. The current way how the EU is structure is totally wrong; and it will not be fixed because those in the system, benefit from it financially. See the recent attempt to force EU taxpayers to pay more for those goons. They constantly try to inflate their own budget, at our cost.
> yet no one can make a phone usable for age verification without the blessing of Google
Indeed. We have total incompetence at the leadership level. It should be replaced with technical prowess, but as long as lobbyists such as Leyen are running the show, nothing will change. See the corruption scandals when she was still in Germany. Interestingly the AfD is also full of that, yet voters don't see it - Weidel was working for many years for Goldman sucks. So a next generation of lobbyists will replace the older generation soon. That's why this system how it is, is unfixable. It is broken by design.
jeroenhd 2 days ago [-]
When did any EU representative ever lie about this? It has been very clear from the beginning that every member state would make their own apps.
I don't really see what internal German politics and lobbying has to do with anything.
As for the "Google" part, that's up to the member states to decide. In essence, the law states that apps should be secure and untampered. It doesn't specify any remote attestation partner, nor even the strict need for remote attestation although it's hard to accomplish any kind of phone-based authentication security without it. Android's native attestation solution also exists and works for phones sold without Google services, though it's an absolute pain to work with.
Sailfish, pmOS, or any other mobile OS could implement the security requirements if they ever get enough serious popularity to convince governments to make apps for them.
tpsvca 2 days ago [-]
[dead]
big85 2 days ago [-]
[dead]
wolvoleo 2 days ago [-]
Site seems slashdotted? Or HNd? Do we call it that here? :)
QuantumNomad_ 2 days ago [-]
Some call it the HN hug of death. Same like with Reddit.
The EU already has some form of digital ID in fact, every government provides some kind of OIDC-like service tied to either smart cards or accounts that authenticate the user against a government. The digital wallet solution is an extension to that system that will allow foreign EU citizens to authenticate themselves more easily (eIDAS 2 already implemented an OIDC-like solution but implementation isn't automatic) as well as offer to store the (often mandatory to carry) ID on your phone.
The "what if you buy alcohol for your kids" sscenario of somone giving someone else their age verification tokens is tired and nonsensical. You can already do that in the real world. We accept that risk and, depending on the country, make it a crime in case they do catch you. It hasn't made liquor stores send someone along to see you drink your booze or watch you enjoy your porn mag.
Imagine if suddenly every grocery, pharmacy, petrol station, parking place, restaurant, bar etc. now would ask you for your ID AND would snap a picture and store in their database - you wouldn't be happy about it.
But you do have a point about "storing the picture". I think that's why it's very important for whatever solution is chosen to be something that proves you're old enough without saying who you are.
At least in my country, the ID app lets you generate 3 levels of QR:
Level 1: Just age (also shows a photo on the screen). This is what you would typically use to go in a club or buy alcohol.
Level 2: Adds Full name, birth date, validity date.
Level 3: All the data you can see on the physical ID card.
As for why would they, the same reason there are hundreds of tracking cookies on every site.
Oh, wait...
The big companies are still mining user data, they are just forced to use some extra dark patterns to trick people into compliance. Would-be criminals are not going to stop being criminals because of the threat of fines. And TLAs are not going to wait for due process to acquire access to data legally.
All that GDPR does is give the illusion that people are being protected and CYA for politicians and bureaucrats when asked "what are you doing about evil Zuckerberg?"
Unless you live at some place where they still accept cash of course, but the writing is on the wall already.
Is there a roadmap and/or a timeframe for that? I have a Slovak ID same as the author, when will it be useful for accessing internet services?
The legal framework behind all this was released all the way back in 2014 and has been officially adopted ten years later.
Officially, by December 2026, each member state must have at least one official wallet solution available for its citizens.
That said, eIDAS 2.0 also mandated that, as of this year, whatever Slovak digital identity solution has been rolled out so far must also work in other member states. In my experience, different governments adopt different foreign identity services at different paces, most of them seemingly missing the deadline.
Banks and other private institutions permitted to ask for ID are supposed to accept the wallet solutions by late 2027.
I expect deadlines to be missed given we've barely gotten the age verification PoC done, but with the groundwork laid out, things might just work out.
My experience working on software for the German public sector sadly agrees with this assesment. Let's hope at least eventually something will work.
This argument stays on the sand of inadequate analogy. The way that flaw is described in the story it allows industrialization of bypassing the feature. It's huge difference with the "real world".
All i would say is that the solution doesn't need to be 100% effective. The same as real world "age gates" or ID verification (which is just some random person looking at your ID in most cases) are not.
The precedent set -- that everything online should NOT be immediately accessible to children -- provides parents (the ones that care at least) with some backup when trying to raise their children. Ultimately society as a whole is responsible children, and i don't want to live in a society that thinks it is fine for kids to scroll any content on social media and watch porn as soon as they are able to work out how to use a smartphone.
The replay attack mentioned may always be a loophole, I'm not sure. But any site hosting the replay attacks should be targeted for shutdown/blocking. The "source" ID must come from somewhere as well, so that could be a route to shutting them down (there are 100's of age verification requests against one ID each day, that's a bit weird...).
If parents are helping their kids bypass age gates or straight up don't care their 11 year old is watching porn, then there is not much to be done in that case. The key thing should be keeping the majority of children in compliance to give cover to the parents that do care. Not giving all the power to bad parents and social media companies as is the situation the moment.
What value is there to industrializing any of this? Kids who will pay someone for their age tokens to watch porn or create social media would probably be smart enough to download a free VPN instead.
Even in the very worst case scenario for the designers of this system, where large amounts of people manage to extract their tokens and hand them out for free, the downsides everyone fears won't apply anymore. I think a lot of people might be happy about that.
Law has privacy downsides and is trivially bypassable -> law is bad.
[0] https://en.wikipedia.org/wiki/It_Can%27t_Happen_Here
This discussion was already led ad nauseam with the Swiss eID proposal (which is supposed to be EUID compatible) and the reason why the system relies on rotating signatures instead of ZKPs is that the cryptography hardware modules in most phones don't support algorithms such as BBS+. This creates a tradeoff where the states would have to essentially roll their own crypto storage and bank on this being safer than simply rotating through batches of signatures generated by the hardware cryptography modules (which is largely unproblematic in the grand scheme of things). The major advantage of using the hardware module is that it makes it much harder for attackers to extract the actual secret should the device ever fall into someone else's hands, something that happens to phones from time to time.
Overall, as with every digital ID thread, it would help if some of the fearmon gering commentators would read the actually EUDI specs for once in their lives as it already addresses most of the concerns copy-pasted into these threads https://eudi.dev/1.6.0/architecture-and-reference-framework-....
Is it the following:
Issuer revokes the wallet of Alice and then publicly says “This ID is Alice btw” and then verifiers can check their lists to see whether any of their received signatures are revoked (in which case they must be Alice)
Section 5 mentions that this issue could be mitigated at some point in the future by using ZKPs, but here's what they're saying about the status of this ZKP integration:
"This topic will be revisited in Topic G to determine the foundational requirements needed for its future integration"
Doesn't sound like this will be implemented any time soon.
[1] https://eudi.dev/2.5.0/discussion-topics/a-privacy-risks-and...
Yeah
I'm getting really really tired of the "crying wolf" crowd
Many Americans don't even have ID (and plenty of those are reluctant to the general concept of any kind of government ID), let alone any kind of digital ID. However, their governments are pushing frankly weird and absurd ID verification laws to businesses online. Meta seems to be bankrolling lobbying around these laws, so whatever their game is, it's probably very bad for normal people.
If you're coming from a place where the government tells companies they need to set up a system or hire private companies to verify users' ages without providing any kind of official mechanism themselves, leading to ridiculous hacks from cheap and incompetent "age verification" companies, I can understand why the European system seems absurd.
If the US is going to adopt their weird age verification laws, the least they could do is fork the European system already laid out for them. Put a little American flag on it, call it "America First Christian Age Truthness" or whatever the people in charge like, but at least keep the basic privacy properties intact.
I don't believe this. "Many" perhaps in raw out-of-context numbers but as a percentage of the population, very few functioning, self-supporting and employed adults in America do not have an ID. It's simply not possible to participate in society without one. You need an ID to register a car, to drive, to vote, to bank, to get a job, to buy a house, to rent an apartment, to get water, power, gas, internet....
If you don't have an ID, you are either a child, or you are deliberately trying to exist off the record. I.e. you are here illegally or you have chosen some very fringe antisocial survivalist offgrid way of living.
Around 10% of American adults do not drive.
6% of American adults do not have a bank account (4% for whites and Asians, 11% for Hispanic, and 14% for Black). It is 23% for people with incomes under $25k [1].
About 20% of adult Americans who are not retired do not have a job [1]. Did you forget that some people live with other people and in many of those arrangements only one of them has a job?
Many people have living arrangements where they are not the owner or the renter of record of the place they live. For example many people who live with others as described above.
Approximately 5% of the US economy is cash based and often does not care whether you have any formal ID. Often people who live mostly in the cash economy live in areas with many other such people, which makes it easier.
[1] https://www.cnbc.com/2024/08/02/23percent-of-low-income-amer...
[2] https://www.minneapolisfed.org/article/2022/whos-not-working...
Cash is still mostly accepted while majority of transactions are digital.
Our focus therefore should be controlling what governments can do with them - for example disallowing blocking/removing someone’s id, just as we should disallow removing citizenship.
It's bad somehow?
Yup, until they are regulated to do so in case you buy booze, porn, metal detectors, crossbows or who knows what else. And until silversmith tries to dodge the draft but he accidentaly bought some booze woth his gov eID to party with friends.
This is what our every day will be like, when the state has internalized the enormous power of a 100% controlled digital ID. Bye, bye, freedom of thought.
If you were to be treated worse than a jew in ww2 germany, you would not be writing about it here.
If you were from outside EU, I fully believe the experience was subpar. 99% or more of verifications went through the EU system, and if you showed up with different kind of documentation, the people tasked with verification "at the edge" might not even know if it was valid form of proof.
Overall, I struggle with being outraged by the concept of digital ID. It's just a digital form of "show me your passport please". We have had physical national ID (mandatory from certain age!) for as long as I can remember myself. The state knows I exist. If a madman gets put in charge, lack of unified digital ID is not going to prevent airport style passport gates being erected around the booze stand.
Then comes this post-hoc rationalization about how it will inevitably be abused, Jews in Nazi Germany, apartheid and chips under the skin.
How will the current approach result in total surveillance?
I would much prefer hotels would have a scanner which just transmits the bare minimum of identifiable information from the ID instead of it being completely normalized in many countries/hotels that they take your ID card and scan the full thing.
Can you explain to me, how with an eID one would be prevented from communicating with anyone or buying food?
Some government (will) make mandatory: social accounts (so also IM apps like IG, WA, X, messanger), banks, buying simcard, internet, buying alcohol, cigarettes, energy drinks).
Some companies will make it mandatory implicitly or explicitly just for profit: selling your consumption data, analytics for themselves. E.g. in poland it's harder and harder to pay with cash because reduced stuff and huge queues - they force your use self checking. The pricing changed also that you have to use their loyalty apps if you don't want to be ripped - otherwise you will be paying 50% more.
> I would much prefer hotels would have a scanner which just transmits the bare minimum of identifiable information from the ID instead of it being completely normalized in many countries/hotels that they take your ID card and scan the full thing.
I don't like it either the problem is right now you mostly this being abused only in some hotels. Whats misleading that that this digital id won't allow tracking because you supposed to "trasmitting the bare minimum of identifiable information"
I prefer hotels without ID requirements. There is not a single shred of sound argument why a hotel needs to know who I am. Therefore I often stay in B&B:s without authoritarian ID-controls.
For example hotels: Some chains may think to advertise using fear mongering, claiming that their hotels are the safest, because they perform background checks based on the information from their customers' ID. You don't want that? Fine! Go elsewhere then! This is private property, if you don't agree to these ToS, you are not allowed to enter or rent rooms, sooo sorry! All you had to do is sign your privacy away here and then let us mine your data ... You don't have anything to hide, do you??
The issue is, that every single involved party from business to government has an incentive to get more data from this system. If there are no laws with guaranteed severe punishments for violations edged into our inalienable human rights and constitutions and those are properly followed up on, in addition to making it technologically impossible to extract more information than necessary, the system sooner or later will be abused.
Why did you only ask about eID and not about "inescapable digital currencies" that was also mentioned in the same paragraph at the top of the thread?
See also: CCP
You see, the government wants to control the people so they can control the government /s
Not really. Government is not Big Tech. This happens with accounts of some tech companies precisely because they're private entities setting their own rules in the still wild "wild west" of the Internet. Governments set laws and processes to ensure the things you mentioned do not happen, except in very specific circumstances.
Think of it this way: being "locked out of life completely", resulting in "no banking, no traveling, no communication", etc. is not a new problem. In the off-line world we call that being sanctioned, imprisoned, deprived of personal freedoms, etc. Yes, it happens to some people, but usually for very specific reasons (called "crimes"), after a lengthy bureaucratic process (called "trial" and "sentencing"), with plenty of safeguards to catch and rectify mistakes during and after the fact (like "legal defenses", "appeals", or even "journalists"). It is not something you normally worry about.
Humanity has worked out best practices for these thing over thousands of years of various tribes and nations and governments forming, disbanding, collapsing, emerging, conquering or becoming conquered. Adding electronic IDs on top does not change the nature of the thing. So you won't get locked out of life for posting the wrong emoji in a tax report comment; that would be like being thrown to prison for drawing something on a government form - or rather, if that's even remotely possible in your country, you have much bigger problems than digital IDs, and your best move would be to emigrate somewhere sane before borders close or civil war starts.
Plenty of other things to worry about here (e.g. ID checks suddenly being required by every business, just because it's zero effort to them for some marginal KYC benefit), but getting banned from life due to ToS violation is not one of them.
As always when information exists digitally and can be processed rather easily, there is a strong temptation to misuse it out of its original purpose. As always there is a high risk of information leaking at some point, especially when in the not that capable hands of big organizations and governments.
The worry is also the drift towards disabling people's IDs for even on of the things the GP listed, at some point for any reason. The one with the bank account for example seems not too unlikely. Say at some point they associate financial information with that id. Banks demand insight on this data on grounds of wanting to grant loans only to people with good history. Later on they don't even want to give you a bank account when you ask, because there is no gain in it for them, because your accounts in the past tended to not have a positive balance and maybe at some point you had solvency issues. Try getting a flat to live in without bank account. Try getting a job without bank account.
The point is, that while governments are not big tech, they are also not tiny friendly grandma Emma's village shop. There are still lots of incentives to misuse and mismanage data, while at the same time governments often do not pay competitive salaries as businesses and often attract a certain kind of people working with your data.
Also keep in mind, that so far basically every such system that was implemented in countries like Germany had severe security holes. Just read up on the "elektronische Patientenakte" for example, or the CCC and the initial eID security issues. Trust has been eroded so far, it is at level zero for the government to get such a thing done right.
In the US there's a requirement for banks to refuse to do business with anyone who would be a "reputational risk". I think it was intended to suppress money laundering. Anyway, when the government calls and says such and such a client represents a reputational risk, the bank doesn't have any choice.
I don't know how it works in other countries, but here in the US you'd be hard pressed to function normally in society without a credit card and bank account.
Options to get around that problem include regulating Apple and Google or mandating that essential services not require accounts with third-party providers.
I would call for both of these things, for independent reasons.
All providers who get relied on in this way should need suitable regulation, even for non-essential things like supermarket loyalty cards.
Apple and Google in particular are now too heavily associated with a government hostile to the EU, therefore the EU should as a matter of urgency ensure that essential services do not require them in particular, and the surest way to do so (and make sure no shenanigans happen with mergers) would be to mandate that essential services do not require accounts with any third-party providers. Not even the postal system or a telephone number, you should always have a viable fallback to some physical office which is open at reasonable hours and is in a reasonably accessible location.
A proper digital ID would eliminate a lot of problems we now have with identity theft, having to obsessively protect names, dates of birth, SSNs in our databases (these things were not considered secrets in the pre-internet era).
Yes, we need to be vigilant about freedoms and privacy. But the idea of a government-issued ID that "proves" who you are is not new and I struggle to think of any way identity can be "proven" without a central issuing authority.
Does it actually follow? It's there for 25 years in some European countries and "everyone" isn't on a government bad list dying of hunger.
The government of course can put you on the list, but they don't need digital id for that. They pass a law, the regulator sends the list to all the banks and boom, you are blocked. I guess we should not have banks or not have the government too.
However lots of countries do allow removing citizenship In the UK it is a political decision too. Lots of countries allow locking people out of other things (e.g. freezing bank accounts). I therefore doubt we an effectively prevent this.
I do not see the problem with physical tokens. They are simple, do not create a single point of failure (if I lose my phone I still have my cards and cash), robust to network and systems failures. What is the drawback? Having to carry a few cards?
I think we should focus on laws against things like that which lead to tyranny rather than attempting to stop progress.
Cash in particular is expensive to produce/process and no longer honours the promise printed on it, it will be phased out as the transactions with it approach 0%.
Cards are really no different than a token in a phone and don’t work for long either in the absence of a network (both will work offline but do need to be reconciled). I haven’t habitually carried a card in about a decade, I think for similar reasons to cash they will die off by general consensus.
1. They are physically separate. They are not likely to be stolen at the same time as a phone. 2. They do not require battery.
Cash has the same advantages, but even more so as it does not rely on networks at all.
If you only have phones as a means of payment what do you do if you phone is lost, stolen or out of battery? How do you even buy a new phone!?
I think phasing out cash is very short sighted. It is robust and reliable. There is a good reason the Swedish central bank recently recommended that people keep a certain amount of cash at home (1,000 SEK, equivalent to about £80/$108/94 EUR, per adult).
The ideal state is having both physical and digital ID. But that will lead to a slow erosion of the willingness to carry physical ID, even if it stays available (which I believe it will for many decades. Even if national ID cards and drivers licenses were to go digital only, passports won't)
However I suspect biometric methods of id verification will render carrying anything redundant long term.
The databases for digital id already exist, they’re just not fully utilised yet and these databases will always be centralised.
Don't want to wake you from that nice dream but that ship has sailed quite a while back, at least here in the EU.
OK. I'll bite. Why are they unnecessary?
Passports have two things. They have information on them, which can be read by looking at them. And they have information on them in chip form, which can be scanned, and is also cryptographically signed by the issuing authority (eg, a government).
To verify a passport you can look at it visually, but you can also scan and validate the info, including photo, in digital form. All you need is the CSCA, the 'country signing certificate' to do so, and there aren't may of those. Small readers exist which are updated with these certs, and so even in the middle of a war zone, with RF jamming, you can verify a country signed what you're looking at.
Relying upon the Internet being there for ID purposes is a massive fail. You'd don't need a networked reachable database to validate that your ID is valid, in a digital way, which can be really helpful with 1M refugees show up at your door during a war, or when the capital city of the issuing nation has been bombed.
You may think this unimportant, but the edge cases are what 99.999% uptime is all about. And the edge cases with ID really need 100% uptime. The last thing you need during a natural disaster is an inability to ... well, do anything.
So even if you have biometric methods to identify someone, you'll also want a local, on person method which has those on chip, and signed by a government saying who you are.
Having ID network connected is also a massive, huge, immense fail. There should be no network connected databases of anything about anyone, in any form. Why? It'll be hacked. This will never, ever, ever change. Never. Paper records can't be hacked en masse, and you can get the same protections by storing records on individual chips with other associated info in paper form.
Dismantling this infrastructure and replacing it with buggy, hackable, online databases just to get digital ID verification is a complete move in the wrong direction. Verifying digitally signed information is not.
And passports can be scanned by phones.
Which means that the info, cryptographically signed, can be verified by anyone in the world too.
Really, what we need is to have everyone chipped, like a pet. Because that's where this ends up, and that's also the only way to always have your ID with you.
As a snarky aside, I've spent my entire life interacting with society all the time, yet only in the last decade has it been necessary to be "carded" constantly to do so. We've literally taken a privacy conscious society, and turned it into a nightmare. I'm identified when I go buy a loaf of bread, the most dystopian, totalitarian government anyone could ever conceive of, is a joke compared to the amount of control and tracking now exercised over people's lives.
So I guess my point is...
If it's annoying and difficult to have to carry around a physical identifier of who you are? And use it regularly?
Why is the solution to make it easier to submit to slavery?
Think that's an over the top statement?
We all know how the US government has pivoted on many things during the current administration. We also know it has had, and continues to have (via private enterprise) a robust degree of information about every fiscal transaction made.
If you look at the McCarthy hearings, they literally went so far as to find documents from decades prior, paper records of course, of people joining socialist clubs in university. Eg, simply sign-in sheets, or their names listed in the minutes of such orgs.
Decades later, that information was used to blacklist careers, destroy lives, not for any proof of malfeasance by those accused, but simply because they were curious in college about socialism.
Those same accused were then used to "name names".
My point is, from the financial data currently being stored about people, anything that makes you stand out in any way could be turned into a problem 10 years down the road. Not to mention, how credit card usage, and digital tracking, and location tracking might hit some pattern.
No one who lived through the McCarthy hearings, just watching them, or lived through how Germany or Russia controlled the lives of their citizens, would ever think any of this increased fingerprint of people is a good idea.
It's all just very dumb. And it will not end well at all.
If CBP's systems go down, they will not process (foreign, they'll process US citizens still) arrivals [1], even with physical passports in front of them. I assume the EU ESS works the same.
"If the internet goes down, your border checkpoint is down" is not some terrifying future we need to protect against, it's the reality of the world as you live in right now.
[1]: I've had to wait for an hour, at SFO of all places, because of exactly that happening.
Why would you need internet? Document holder smartphone can cache the document for years and present it over NFC (including photo, signature, etc). Just like existing biometric passports work, but replace the physical passport with smartphone app.
The internet requirement is not there for the person presenting the document, it's for the person/system checking it.
History of entry and visas/etc could be stored on device as well
But in the real world, the systems that deal with processing people's entries already cross-reference multiple other existing databases, require internet connectivity to do so, and I think you'll have hard time convincing anyone to stop doing that.
Couldn't agree more. The more we know, the more susceptible we are to bias and division.
So yeah, I'd expect those to move to a phone as an alternative to the card
Even with that: There's plenty of services dangerous to kids that we gate behind an ID check and I don't particularly see why internet is special in any way.
No one claimed the internet should receive special treatment. The two forms of ID check that you're attempting to equate aren't the same.
If I lose my passport I am obliged to call the police so that they revoke it, if I lose my phone with my digital ID on it they also need to be able to revoke that ID.
I don’t think governments should be allowed to do that. They do it with passports and I think it’s deeply wrong but also it would be far more damaging and immediate with a digital id (which will inevitably be used for a lot of services) - similar to being refused a bank account.
The government should always be assumed to be evil, and work towards complete and ultimate power. It is a cancer that spreads.
Therefore decentralization, and a private libertarian society, is the only ethical and long term sustainable society possible. Every other society, eventually collapses into authoritarianism and the burning of the jews.
> Physical tokens like bank cards and driving licenses are neither necessary nor a good solution in a networked world.
I see absolutely nothing wrong with physical tokens. You could reason that this or that has more or fewer advantages but to insinuate that digital is always better, all of the time, is simply wrong.
In some places you cannot. I was in London post-COVID and there were a bunch of tourist things, like a riverboat on the Thames, where you could only pay with a card. Went to a craft cider bar out in the countryside and again, they didn’t accept cash. Personally, I think businesses should be forced to accept all legal tender, which means cash stays as a first class payment method, but that’s not how it is in many places.
On the other hand, in Austria there are many places that are cash only, especially small restaurants in the countryside or community sporting events with coffee bars.
In web of trust, anyone could publicly certify who they know is a real person (i.e. validate a link from their id to another id). Then, if you received a message from someone, the system would find the path in the graph of real people you trust, to determine the trustworthiness of the source. So if the account is a bot, there would be no path from it to you in the trust graph.
The advantage is that everyone could supply their own subjective trustworthiness score, altering the graph. They could even publish it, so that other people could use trustworthiness assesment of accounts they personally trust.
The big issue with a system of web of trust is that it is too efficient, and just kills commercial advertising (and also propaganda). Because that is all about overcoming the natural web of trust that humans have.
This is propaganda, none of those supposed networks exists or were successful in anything and when the media do show some supposed accounts they don't have a lot of views. Please stop falling for this, your democracy sucks because the politicians suck and the people want change so they turn to extremist parties.
Countries have been interfering in the internal workings of other countries for centuries, if not millennia. If you want to read up on more recent accounts of this, many of which predate social media, the book Active Measures by Thomas Rid is a good place to start.
Or you can continue to think that this is all just made up "propaganda" and we're all fools, but you alone have seen the light.
By forcing us to go through devices completely controlled by US companies?
https://news.ycombinator.com/item?id=47644406
Whitelabel/demo implementation specifically pushes FOR Google Play Integrity after being explained why that's a bad idea: https://github.com/eu-digital-identity-wallet/av-doc-technic...
Via: https://discuss.grapheneos.org/d/24452-eu-might-enforce-goog... which specifically quotes the law that should forbid such approach (Article 6(4) DMA) - so EU initiative and engineers consciously and intentionality breaking EU law in the prototype that is supposed to be replicated later.
Wouldn't it be strange if solving a problem didn't affect elections?
But it's becoming increasingly clear how badly compromised the whole thing is with fake opinions and enemy propaganda.
I don't like either of the options. I don't like control by the state, and I don't like control by mad billionaires. I don't like the far right cesspool of 4chan, but can't disagree with their position that they shouldn't have to care about OFCOM.
While I agree with this statement, I thought there was some kind of requirement that OFCOM goes through a process like this before being allowed to ask for a domain to be blocked in the UK?
The latter is, I think, something OFCOM should be allowed to do with a restriction that it can only come after other options fail.
Imgur have gone the other direction: they have voluntarily blocked the UK (!), which is very irritating when trying to browse Reddit.
There's certainly a process, but not a good one.
(separate from all this, the Internet Watch Foundation maintains a blocklist which ISPs voluntarily follow, of actual CSAM.)
Until the process is complete, that's not evidence of inability, that's just the process:
- https://www.ofcom.org.uk/online-safety/illegal-and-harmful-c...> There's certainly a process, but not a good one.
Indeed. There does seem to be a mutual non-comprehension of how the internet functions amongst lawmakers and enforcers in both the UK and the USA; both seem to act like they have more sovereignty over the internet than is possible without reaching much faster for a block order for sites outside their respective jurisdictions.
The governments themselves are "dumber, sadder, and more scared". They are worried because social media puts regular people talking on equal footing to official propagandas (being able to reach everybody else). That's what they fear, because they have the lowest approval ratings and legitimization in over half a century, and they're also making everything shittier and shittier to the benefit of their corporate overlords.
The problem is the algorithm and the "explicitly suppressed and censored" and that's on the governments and corporations. So that's the worst argument for giving the government more control.
That argument seems easily debunked by pointing at the effectiveness of propaganda, which is in its essence indistinguishable from bots.
People have control over their government, at least in democracies that are functioning to a basic level (see Hungary recently). But they have zero control over social media, in fact the only organisations that can control global billion dollar tech companies are nation state governments...
That kind of serves as a proof to your opinion it's a boogeyman.
https://www.reuters.com/legal/litigation/musk-summoned-by-fr...
But they would gladly use that for more control.
That would be a very gentle way to express hurt feelings, not the way to treat a guy who knowingly does that.
Even more reason to make the "demo" app do things correctly because it's very unlikely that all member states actually implement things correctly.
> The internet is scary, parents think they can’t protect their children from many bad things happening, and someone came to provide a “solution."
A simple solution is just not providing your kids with a phone or computer.
Don't forget that many sources of porn will not obey this. Think the pirate bay will ask for age verification? If they obeyed the law they wouldn't even exist.
It's a solution for nothing, as the article points out too.
The idea that we want a single database or a network without any kind of control is frightening me
Why would you correct data about you very own surveillance ?
Some amount of id verification and surveillance is of course required for a government to function, the question should be more what is allowed and what is not.
I'll assume your answer is no, and I that case surely you must see the value in that medical record being correct.
Concerning the railway example, they only need to store how much I owe them, not my travels. Storing travel history on their end is already surveillance.
Data keeping purpose and consents are what make something surveillance or not. Forcing every citizen to use ID to access the web is surveillance plain and simple.
No, I am legitimately asking to clarify your position, hence why I assumed you wouldn't call that surveillance. The point was for us to agree that the right to correct data is a meaningful and useful right to have.
Once we've clarified that, the rest of the arguments comes down on the separation of "surveillance" from "record keeping", a separation you attribute to "Data keeping purposes and consents". That aligns with current EU law, and I largely agree with treating that as a separation point. If you have a valid purpose, either by law or by duty to your customer, you get to keep records necessary to fulfill that need. I would note that these "duty to your customer" clauses are usually pretty broad and would, I imagine, allow the railroad company to keep and process your travel record for fraud prevention purposes.
The issue we encounter is what a valid "data keeping purpose" is, and if we trust our public institutions and infrastructure to govern that question. Especially when the potential data processors is a government agency. This I'm entirely uninterested in debating that question with a rando on HN. We likely live in two very distinct regulatory frameworks and have vastly different local governments. There's no basis for us to agree here.
I would however end by noting that the two clauses of your statement
> Data keeping purpose and consents are what make something surveillance or not.
and
> Forcing every citizen to use ID to access the web is surveillance plain and simple.
Are in tension with one another. Clause 1 opens up for the idea that there exists valid "non-surveillance" record keeping, and that the distinction of such record keeping from surveillance requires determination of consent and purpose. Clause 2 then foregoes that determination and just presupposes the argument. All ID checks are definitionally surveillance irrespective of purpose and consent.
In the current legal framework, government derives it's unilateral consent from the vote. If the law passes in a democratic system then it is, by that very process, a consensual and valid purpose.
"Forcing" highlights the lack of consent, the distinction is still present.
> In the current legal framework, government derives it's unilateral consent from the vote. If the law passes in a democratic system, then it is, by that very process, a consensual and valid purpose.
Absolutely not. Being voted in a parliament doesn't mean citizens consented to it.
Simple example: compulsory military enrollment vs voluntary military enrollment. Only one of them derive from consent, even if both derive from a law discussed in parliament.
For example this would allow a state to refuse access to the PI of their citizens for cases that are not administratively documented. This forces the access audit sufficiently that a malign actor cannot simply request data for a citizen without having probable cause ; another vector we want to protect ourselves against is simply the psycho/sociopaths that have access to these data without surveillance.
The way I understand it is more like tls certs, with each country managing their own root cert.
That’s not a solution. Nowadays many schools require access to a computer.
Also the class schedule including the substitutes are communicated per smartphone app
Also, remote attestation doesn't work that way and for good reason. Under a true ZKP system, a single defector (extracted/leaked/etc key) would be able to generate an infinite number of false attestations without detection.
This article is about EU age verification which is specifically and definitely stated as using zero knowledge proof in all technical docs that I've seen:
https://eudi.dev/2.5.0/discussion-topics/g-zero-knowledge-pr...
It certifies devices running on Oreo (because vendor didn't provide updates),meaning there are almost infinite vulnerabilities that will allow to leak the keys.
"EU Age Control" is not a Trojan Horse. The software (app) does what it purports to do. No one _wants_ to use it
The "Trojan Horse" is the corporate mobile OS. It's a "free gift". People such as the author happily accept it. These people _want_ to use the corporate mobile OS for what they believe it is, which is something other than software to defeat privacy for the benefit of Google, Apple and their advertiser business partners and customers
People don't think of the software as performing that function. Meanwhile it is the core "business model" of its distributor. The corporate mobile OS is a Trojan Horse
This is why the "age verification" app only works when using the corporate mobile OS. The author states:
"The apps will not work unless you have a Google or Apple approved device. Forget Linux, GrapheneOS, Huawei, after-market firmwares. It's part of the security model."
The bogus justification for requesting ID is not "age verification" it is "security". That's the nonsense reason why the computer owner cannot use an OS he/she compiles himself/herself and why people happily accept the Trojan Horse. The corporate mobile OS is an instrument of data collection, surveillance and online advertising but that's not how the author sees it. He does not see what's inside, he sees a beautiful "free gift"
It's not for digital IDs. It's for surveillance.
Digital IDs are fine (and desired even) if you are only requiring it for GOVERNMENT (same entity that released them) communication. Push for age control is scheme to make that info available for private companies and that's the trojan horse here.
That info being: {"over_18": true} or maybe {"over_16": true, "over_18": false} with a government signature.
Might be a problem if you've got a Vatican ID, I suppose? Though they don't participate in this system of course.
The question is whether citizens can build enough pressure for such verification systems to be state-based and truly zero-knowledge (akin to the EU's) versus having the private sector 'verify' each user to siphon data, profit off it (Thiel's Persona) and fortify surveillance-capitalism and autocratic administrations.
I'd be happy to have a government service replace all that nonsense, where a one-time challenge code could verify my ID. There is now a UK.gov "One Login" authentication used by other government services that is essentially a digital ID as far as I can see. It just needs to be made mandatory for ID checks by law.
Such a service can also be used for age verification with the correct privacy controls in place, far better than all the dodgy age verification services that exist now.
Digital ID and age verification are going to be a part of the internet going forward. I'd rather have a government service that (in a functioning democracy) has accountability to the citizens that use it. ID verification is also a natural monopoly, so the government picks a winner anyway.
The fantastic irony is that in some weak attempt to protect against the "evil big tech companies" they directly facilitate increased mass surveillance and removal of individual rights, instead of choosing more scalable and robust answers such as funding and promoting the development of protocols and open standards that can be applied voluntarily and in a decentralized manner to help mitigate these problems.
I have computers side by side on my desktop running Linux, and it is amazing to me how I can call `wormhole send --message hello` and receive it on the machine next to me, knowing that only I can receive this message, without it running through an age approval mechanism, without it being client-side scanned, and without being logged in some government database.
This is the century of AI and robotics - technologies which can facilitate great concentration of power and wealth. Gradually introducing mechanisms that facilitate digital fascism seems like a really bad way to guard us against this.
https://www.nrk.no/norge/datatilsynet-bekymret-for-personver...
Anyone else here planning on blocking sites that require age / ID verification? Are there any publicly available domain deny-lists that could be added to uBlock yet?
As mentioned digital ids are a thing and this is where everything is moving. The author mentions that it would be great to use it but does not believe it is possible and then says age checks will lead to it and it is bad. There are reasons why digital ids will be forced and one of the big ones is because bigtech companies do not want to invest into looking after the content, e.g. misinformation, bullying, etc. Not to mention the inability of companies to control the age of users, and everyone knows this is not in the interest of advertisers.
Criticism is good but it also has to offer some options. Saying everything is bad bad does not help. All in all I have kids and it is very difficult to filter all of their internet traffic and I am not your average parent. Kids are reading crap and get brainwashed everyday, and the idea that you should just let them is ridiculous. Cyber bullying is a thing and I wonder what would you do when your kids get to be on the receiving side.
IMO this is trying to blame politicians who represent their electorate who wants this without acknowledging that the issue is in huge ad funded companies whose interest is to gather all that private data without any supervision or filtering. BTW Data is constantly being leaked from large companies as well, not only gov entities.
In relation to guesstimates the author jumps to possible conclusions without sufficient proof.
What would the author suggest to fix the main issues though?
- If you rely on Big Tech for your identity and data you loose all privacy but can expect some security.
- If you go with your government you still loose your privacy but also all security.
I saw on HN just in the last month that the EU and France got hacked and very sensitive data is now on the Internet.
Not much more freedom, but the control is outside voters reach.
Just ask Nicolas Guillou
0. https://www.youtube.com/watch?v=RfukJ6uVHXs
Besides, if someone wants a digital ID, it already exists in many countries. Phones with NFC chips can read many passports, e.g. Germany has an "electronic passport" since 2005. It's barely used, though, because it's bullshit.
We'll need to apply for digital IDs for bots and AI agents?
This shows that the EU commission is systematically lying.
This problem used to exist in the past with Leyen - she is ultimately a lobbyist and that has to stop. Friedrich Merz too by the way - there is a reason why recent polls indicate that the german voters want him out of politics at once.
The EU needs to reform. Right now lobbyists have too much abuse-power. The age sniffing is a great example here - isn't it suspicious how this goes in sync right now in so many countries? Who is paying for this? Nobody needs that, except for some companies.
> Big platforms must verify age for certain content.
But why is their concern, suddenly my concern? I see no need to be in support of any law that would require people to ID in order to access information on the world wide web. That's very obviously the real goal and agenda - everyone with a bit of brains sees this.
> It is the same EU that hates these American corporations and wants EU alternatives for everything
That's not true. The EU commission I consider a lobbyist group, for instance. They lie and lie and lie.
The EU parliament is not much better - you can buy legislation quite easily: https://en.wikipedia.org/wiki/Qatar_corruption_scandal_at_th...
Nothing will seriously changed. The current way how the EU is structure is totally wrong; and it will not be fixed because those in the system, benefit from it financially. See the recent attempt to force EU taxpayers to pay more for those goons. They constantly try to inflate their own budget, at our cost.
> yet no one can make a phone usable for age verification without the blessing of Google
Indeed. We have total incompetence at the leadership level. It should be replaced with technical prowess, but as long as lobbyists such as Leyen are running the show, nothing will change. See the corruption scandals when she was still in Germany. Interestingly the AfD is also full of that, yet voters don't see it - Weidel was working for many years for Goldman sucks. So a next generation of lobbyists will replace the older generation soon. That's why this system how it is, is unfixable. It is broken by design.
I don't really see what internal German politics and lobbying has to do with anything.
As for the "Google" part, that's up to the member states to decide. In essence, the law states that apps should be secure and untampered. It doesn't specify any remote attestation partner, nor even the strict need for remote attestation although it's hard to accomplish any kind of phone-based authentication security without it. Android's native attestation solution also exists and works for phones sold without Google services, though it's an absolute pain to work with.
Sailfish, pmOS, or any other mobile OS could implement the security requirements if they ever get enough serious popularity to convince governments to make apps for them.