this post was submitted on 27 Jul 2025
563 points (99.1% liked)

Technology

73416 readers
4142 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
L4s@hackingne.ws
563
EU age verification app to ban any Android system not licensed by Google (www.reddit.com)
submitted 3 days ago* (last edited 3 days ago) by Gsus4@mander.xyz to c/technology@lemmy.world
121 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] General_Effort@lemmy.world 1 points 1 day ago (1 children)

The reverse is also a necessity: the government approved service should not be allowed to know who and for what a proof of age is requested.

It would send the proof to you. It would not know what you do with it. I gave an example in the previous post how the identity of the user could be hidden from the service.

If the middle man government service knows when and who is requesting proof-of-age, it’s easy to de-anonymise for example users of gay porn sites.

It would be a lot easier to get that information from the ISP.

[–] iii@mander.xyz 1 points 1 day ago (1 children)

I gave an example in the previous post how the identity of the user could be hidden from the service.

In both your examples the government service has your full identity, then pinky promises to forget it.

Unless I'm misunderstanding something?

It would be a lot easier to get that information from the ISP.

Not quite the same, as IP addresses are shared through NAT, VPNs exist, etc. With the proposed legislation it is illegal for website operators to deliver content to known VPN ips, as they cannot confirm that the end user isn't a EU subject.

[–] General_Effort@lemmy.world 1 points 19 hours ago (1 children)

In both your examples the government service has your full identity, then pinky promises to forget it.

It can be like buying alcohol in a store. They look at you and see your age. Or if it's unclear, the store clerk asks your idea and promptly forgets all about it. Except you're not buying alcohol but a login for some age verifier.

[–] iii@mander.xyz 1 points 12 hours ago* (last edited 8 hours ago) (1 children)

So yes, they get your identity, then promise to forget it.

That's a worst of both worlds proposal: it makes it trivial to deanonymise people, and it doesn't solve the replay attacks.

[–] General_Effort@lemmy.world 1 points 7 hours ago (1 children)

Maybe buying alcohol works differently where you live.

[–] iii@mander.xyz 1 points 7 hours ago

They ask for ID card indeed, making it super easy to just make a copy. On top of that, your payment details are stored. You're on camera. Etc.

Super easy to automate deanonymization. (1).