409
submitted 6 days ago by schizoidman@lemmy.zip to c/privacy@lemmy.ml

cross-posted from: https://sh.itjust.works/post/42943610

Taken from the readme of the app on github:

The current release provides only basic functionality, with several key features to be introduced in future versions, including:

App and device verification based on Google Play Integrity API and Apple App Attestation

Additional issuance methods beyond the currently implemented eID based method.

These planned features align with the requirements and methods described in the Age Verification Profile.

There is an issue opened to remove this as it's basically telling us that to verify our age in the EU an American corporation has the last word, making it not only a privacy nightmare but a de-facto monopoly on the phone market that will leave out of the verification checks even the fairphone (european) with /e/os.

top 20 comments
sorted by: hot top controversial new old
[-] majster@lemmy.zip 98 points 6 days ago

In digital age it should be understood as a personal liberty to not be compelled by state to use nonfree software in any shape or form. Just like court rulings must be public and legislation too (sadly this doesn't apply in EU).

[-] Ulrich@feddit.org 5 points 6 days ago
[-] trevor 51 points 6 days ago

The EU governing bodies are speaking out of both sides of their mouths if they claim that they want data sovereignty while simultaneously relying on an evil, American company to verify your "integrity" 🤡

You'll never be sovereign if you rely on a for-profit entity that makes money by spying on people and selling your data.

[-] Evil_Shrubbery@lemmy.zip 28 points 5 days ago* (last edited 5 days ago)

What in the fuckety anti-anti-trust megacorp win is this???

Where is the petition to sign??

[-] ell1e@leminal.space 25 points 6 days ago* (last edited 6 days ago)

The main problem isn't the Google Play integration, but that this requires an Android or iOS device at all. This should be based on something like flutter or electron, and be easily portable with an agnostic build script for e.g. Linux, UBports, postmarketOS, and so on, as well. If only for the reason that most Android and iOS devices will effectively become unpatchable after the mandatory 5-ish years run out, while a standardized UEFI desktop platform will not. There are so many reasons not to have a "standard" smartphone nowadays. Also see here.

[-] vzqq 32 points 6 days ago* (last edited 6 days ago)

Maybe you shouldn’t provably tie your identity to a privacy phone?

[-] utopiah@lemmy.ml 28 points 6 days ago

I agree with most concerns here but as a professional prototypist... people do not seem to understand here and on related issues what "reference implementation" means.

This is NOT supposed to be used! By anybody! This is basically a technical demonstration that shows how it can be done at all.

Think of this as a test suite rather than software proper.

Again, this does not mean it's OK to even suggest that Google and Apple are in any way acceptable bottleneck. I do believe those are terrible choices. I do also believe relying on them just to do a proof of concept or technical demonstration is quite "lazy" but I also bet that this was necessary due to the scope of the project, e.g. "deliver us an app that works in 6 months on an average mobile phone". I really don't think they had discussion on accessibility, inclusion, etc.

So... yes, do keep track and be concerned but also don't conflate a proof of concept with a maintained app that will be required to be used on all EU citizen mobile phones next year.

[-] xthexder@l.sw0.com 15 points 6 days ago

There's a big difference between a reference implementation and a proof of concept. A proof of concept just shows it's possible at all, but a reference implementation is meant as a reference for "you should do it this way". Expect most companies to just directly copy the reference because they'll feel it's a waste of time developing their own system that's in compliance.

[-] ell1e@leminal.space 13 points 6 days ago* (last edited 6 days ago)

This is definitely going to be copy&pasted as a foundation in many EU states. Therefore, that it requires Android and iOS at all, let alone Google Play, is a fundamental error. Some people avoid smartphones for good reasons, yet still access parts of the internet that may apparently soon be gatekept by this new age verification mechanism. Also see here.

[-] utopiah@lemmy.ml 3 points 5 days ago* (last edited 5 days ago)

Sure it's beyond a proof of concept and others will definitely heavily rely on it yet my point still stand, i.e no one is supposed to install this built app directly. As I also said yes it's wrong to rely on Google and Apple in general but even more so with talks of EU sovereignty so I'm not giving them any slack for that. What I'm still insisting on is that this repository is not the app people will have to use.

[-] umbrella@lemmy.ml 18 points 5 days ago

identify yourself, citizen.

[-] xiwi@lemmy.dbzer0.com 14 points 5 days ago

You have a license for that opinion?

[-] FriendOfDeSoto@startrek.website 15 points 6 days ago

This verification efforts were kicked off earlier this month; this app hasn't really launched yet, has it? I think proper implementation after a test phase will maybe come next year. I think it is too early to complain that aftermarket OS's are being excluded. It seems to me that nobody has tackled that problem yet rather than this being a willful exclusion. And while the EU lawmakers thought it was okay to put the Googles of the world in a position where they get to be judge, jury, and executioner for the right to be forgotten, I have a feeling that GDPR and the general vibe within the EU will not allow this to only work with the help of one American corporation on the continent's most used OS. We need to be watchful but not despairing just yet.

[-] utopiah@lemmy.ml 6 points 6 days ago

It will never launch, it's an example of how it can be done.

[-] Undertaker@feddit.org 1 points 6 days ago
[-] RiQuY@lemmy.zip 15 points 6 days ago

Graphene OS can give apps access to the Google Play Integrity API.

[-] ell1e@leminal.space 6 points 6 days ago
[-] juanro49@masto.nobigtech.es 2 points 6 days ago

@schizoidman The @EUCommission likes free software, but not very much, lest the big technology companies get upset and stop receiving briefcases of money.

this post was submitted on 28 Jul 2025
409 points (100.0% liked)

Privacy

40451 readers
365 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS