@EUCommission This is great, but misses the forest for the trees:
* Google is rapidly closing Android by making it harder to install apps from outside the Play Store.
* Google is rapidly closing Android by limiting AOSP to two drops (main release, QPR2) a year.
* Google makes it harder for alternative systems by putting a 3 month embargo on security patches, which they only give to OEMs.
* Google forces competitors out of the market with Play Integrity.
@david @bjoreman @HennaVirkkunen The problem with most age attestations is that you can work out someone's birthday by keeping track of past attestations. When the attestation changes, someone had their birthday, thus the attestation gives away information that someone might not want to reveal.
This gets worse with implementations with which you can test age brackets (different age brackets under 18, to allow some content).
@david @bjoreman @HennaVirkkunen So, the problem with age verification is that it is yet another attack on privacy. Not surprisingly, behind the scenes Meta is pushing this a lot through various sock puppets.
@david @bjoreman @HennaVirkkunen Also, age verification is strongly detrimental to open source and your freedom to choose your OS.
Most implementations of 'anonymous' age verification require remote hardware attestation (eventually), because otherwise you can manipulate the app/process that partakes in the attestation.
Mandatory remote attestation is pretty much the end of free OS choice, because you running your own non-approved software will shut you out of services.
@david @bjoreman @HennaVirkkunen Age verification + remote attestation is big tech's pipe dream. Google can already shut out competing systems from phone NFC payments, because pretty much every bank only supports Google/Apple Pay and Google doesn't attest alt-OSes.
Remote attestation of websites would be another level, making it practically impossible to live outside the Google/Apple duopoly.
@david @bjoreman @HennaVirkkunen For these reasons, Europeans should outright reject age verification.
Yes, I know it is difficult when kids can pretty much access anything, but as parents we have to find better ways than those that further kill privacy and entrench big tech players.
@david @bjoreman @HennaVirkkunen
You are missing my first point, even if an age attestation method does not reveal the birth date, you can infer the birth date from it because some day the attestation will flip from 'false' to 'true'.
Second, Spain is piloting the EUDI Wallet for age verification, which will implement remote attestation:
@david @bjoreman @HennaVirkkunen On the point of using identity documents directly: either you have to send the signed attestation to the site/app for verification, which would deanonymize you; or some gatekeeper like a government site would have to do it and give the result to a site/app and in that case the gatekeeper knows what apps/sites you are using, which is a huge privacy invasion. Also doesn't protect well against a kid using someone else's ID to verify, so it's mostly security theater.
@david @bjoreman @HennaVirkkunen At any rate, Mastodon is too short a format to go into the details of issues with ZKPs for age attestation, so some useful pointers:
@danieldk @david @HennaVirkkunen Yeah, it’s not like there are no tools today for parents to control what kids can access.
@david @bjoreman @HennaVirkkunen The problem with most age attestations is that you can work out someone's birthday by keeping track of past attestations. When the attestation changes, someone had their birthday, thus the attestation gives away information that someone might not want to reveal.
This gets worse with implementations with which you can test age brackets (different age brackets under 18, to allow some content).
@david @bjoreman @HennaVirkkunen So, the problem with age verification is that it is yet another attack on privacy. Not surprisingly, behind the scenes Meta is pushing this a lot through various sock puppets.
@david @bjoreman @HennaVirkkunen Also, age verification is strongly detrimental to open source and your freedom to choose your OS.
Most implementations of 'anonymous' age verification require remote hardware attestation (eventually), because otherwise you can manipulate the app/process that partakes in the attestation.
Mandatory remote attestation is pretty much the end of free OS choice, because you running your own non-approved software will shut you out of services.
@david @bjoreman @HennaVirkkunen Age verification + remote attestation is big tech's pipe dream. Google can already shut out competing systems from phone NFC payments, because pretty much every bank only supports Google/Apple Pay and Google doesn't attest alt-OSes.
Remote attestation of websites would be another level, making it practically impossible to live outside the Google/Apple duopoly.
@david @bjoreman @HennaVirkkunen For these reasons, Europeans should outright reject age verification.
Yes, I know it is difficult when kids can pretty much access anything, but as parents we have to find better ways than those that further kill privacy and entrench big tech players.
@david @bjoreman @HennaVirkkunen
You are missing my first point, even if an age attestation method does not reveal the birth date, you can infer the birth date from it because some day the attestation will flip from 'false' to 'true'.
Second, Spain is piloting the EUDI Wallet for age verification, which will implement remote attestation:
@david @bjoreman @HennaVirkkunen On the point of using identity documents directly: either you have to send the signed attestation to the site/app for verification, which would deanonymize you; or some gatekeeper like a government site would have to do it and give the result to a site/app and in that case the gatekeeper knows what apps/sites you are using, which is a huge privacy invasion. Also doesn't protect well against a kid using someone else's ID to verify, so it's mostly security theater.
@danieldk @david @HennaVirkkunen Yeah, it’s not like there are no tools today for parents to control what kids can access.
@david @bjoreman @HennaVirkkunen that site somehow doesn't seem to work here. But in general, these proposals fail, because sites can regularly probe for age brackets. If you do this on a regular basis, you can figure out someone's birthday.
E.g. if 12 years is a bracket boundary, the day that age gets attested is the birthday of the kid. Even more likely because someone is more likely to check close after their birthday to unlock some site/functionality.
@david @bjoreman @HennaVirkkunen The problem with most age attestations is that you can work out someone's birthday by keeping track of past attestations. When the attestation changes, someone had their birthday, thus the attestation gives away information that someone might not want to reveal.
This gets worse with implementations with which you can test age brackets (different age brackets under 18, to allow some content).
@david @bjoreman @HennaVirkkunen So, the problem with age verification is that it is yet another attack on privacy. Not surprisingly, behind the scenes Meta is pushing this a lot through various sock puppets.
@david @bjoreman @HennaVirkkunen Also, age verification is strongly detrimental to open source and your freedom to choose your OS.
Most implementations of 'anonymous' age verification require remote hardware attestation (eventually), because otherwise you can manipulate the app/process that partakes in the attestation.
Mandatory remote attestation is pretty much the end of free OS choice, because you running your own non-approved software will shut you out of services.
@david @bjoreman @HennaVirkkunen Age verification + remote attestation is big tech's pipe dream. Google can already shut out competing systems from phone NFC payments, because pretty much every bank only supports Google/Apple Pay and Google doesn't attest alt-OSes.
Remote attestation of websites would be another level, making it practically impossible to live outside the Google/Apple duopoly.
@david @bjoreman @HennaVirkkunen For these reasons, Europeans should outright reject age verification.
Yes, I know it is difficult when kids can pretty much access anything, but as parents we have to find better ways than those that further kill privacy and entrench big tech players.
@david @bjoreman @HennaVirkkunen
You are missing my first point, even if an age attestation method does not reveal the birth date, you can infer the birth date from it because some day the attestation will flip from 'false' to 'true'.
Second, Spain is piloting the EUDI Wallet for age verification, which will implement remote attestation:
@danieldk @david @HennaVirkkunen Yeah, it’s not like there are no tools today for parents to control what kids can access.
@HennaVirkkunen How is that to be done without handing these platforms our identities and ability to track us? Seems the last thing I want is for them to be trusted with anything.
@david @bjoreman @HennaVirkkunen that site somehow doesn't seem to work here. But in general, these proposals fail, because sites can regularly probe for age brackets. If you do this on a regular basis, you can figure out someone's birthday.
E.g. if 12 years is a bracket boundary, the day that age gets attested is the birthday of the kid. Even more likely because someone is more likely to check close after their birthday to unlock some site/functionality.
@david @bjoreman @HennaVirkkunen The problem with most age attestations is that you can work out someone's birthday by keeping track of past attestations. When the attestation changes, someone had their birthday, thus the attestation gives away information that someone might not want to reveal.
This gets worse with implementations with which you can test age brackets (different age brackets under 18, to allow some content).
@david @bjoreman @HennaVirkkunen So, the problem with age verification is that it is yet another attack on privacy. Not surprisingly, behind the scenes Meta is pushing this a lot through various sock puppets.
@david @bjoreman @HennaVirkkunen Also, age verification is strongly detrimental to open source and your freedom to choose your OS.
Most implementations of 'anonymous' age verification require remote hardware attestation (eventually), because otherwise you can manipulate the app/process that partakes in the attestation.
Mandatory remote attestation is pretty much the end of free OS choice, because you running your own non-approved software will shut you out of services.
@david @bjoreman @HennaVirkkunen Age verification + remote attestation is big tech's pipe dream. Google can already shut out competing systems from phone NFC payments, because pretty much every bank only supports Google/Apple Pay and Google doesn't attest alt-OSes.
Remote attestation of websites would be another level, making it practically impossible to live outside the Google/Apple duopoly.
@david @bjoreman @HennaVirkkunen For these reasons, Europeans should outright reject age verification.
Yes, I know it is difficult when kids can pretty much access anything, but as parents we have to find better ways than those that further kill privacy and entrench big tech players.
@david @HennaVirkkunen That sounds reasonable-ish. I hope they don't build regulations which create a sea of very poor malicious compliance.
We say this loud and clear: online platforms are responsible for protecting minors, and they need to do more to deliver on this responsibility.
The full press releases:
🔗 https://ec.europa.eu/commission/presscorner/detail/en/ip_26_722
🔗 https://ec.europa.eu/commission/presscorner/detail/en/ip_26_723
@HennaVirkkunen How is that to be done without handing these platforms our identities and ability to track us? Seems the last thing I want is for them to be trusted with anything.
@david @bjoreman @HennaVirkkunen that site somehow doesn't seem to work here. But in general, these proposals fail, because sites can regularly probe for age brackets. If you do this on a regular basis, you can figure out someone's birthday.
E.g. if 12 years is a bracket boundary, the day that age gets attested is the birthday of the kid. Even more likely because someone is more likely to check close after their birthday to unlock some site/functionality.
@david @bjoreman @HennaVirkkunen The problem with most age attestations is that you can work out someone's birthday by keeping track of past attestations. When the attestation changes, someone had their birthday, thus the attestation gives away information that someone might not want to reveal.
This gets worse with implementations with which you can test age brackets (different age brackets under 18, to allow some content).
@david @bjoreman @HennaVirkkunen So, the problem with age verification is that it is yet another attack on privacy. Not surprisingly, behind the scenes Meta is pushing this a lot through various sock puppets.
@david @bjoreman @HennaVirkkunen Also, age verification is strongly detrimental to open source and your freedom to choose your OS.
Most implementations of 'anonymous' age verification require remote hardware attestation (eventually), because otherwise you can manipulate the app/process that partakes in the attestation.
Mandatory remote attestation is pretty much the end of free OS choice, because you running your own non-approved software will shut you out of services.
@david @bjoreman @HennaVirkkunen Age verification + remote attestation is big tech's pipe dream. Google can already shut out competing systems from phone NFC payments, because pretty much every bank only supports Google/Apple Pay and Google doesn't attest alt-OSes.
Remote attestation of websites would be another level, making it practically impossible to live outside the Google/Apple duopoly.
@david @HennaVirkkunen That sounds reasonable-ish. I hope they don't build regulations which create a sea of very poor malicious compliance.
@HennaVirkkunen I think officials should re-examine the unspoken assumption that small children must be hooked up to whatever remote computers.
Car analogies work well in this area. If the Internet is the "information superhighway", then why are parents expecting little Johnny and Susan to play out on the highway? Just a generation ago it would have been framed as abuse and neglect, but now our children must somehow be steeped in the SV wizardry or else they will wither on the vine...?
You're lying as shamelessly as Trump, Putin, Musk, Zuckerberg and all the other US tech fascists.
Keeping kids safe online is a top priority.
Today, the Commission has preliminarily found porn platforms Pornhub, Stripchat, XNXX, and XVideos in breach of the Digital Services Act for allowing minors to access adult content.
We’ve also launched investigation into Snapchat under doubts that the platform has failed to adequately protect minors from harmful content, grooming, and illegal products like drugs and vapes. We also suspect that they have failed to verify users age sufficiently.
We say this loud and clear: online platforms are responsible for protecting minors, and they need to do more to deliver on this responsibility.
The full press releases:
🔗 https://ec.europa.eu/commission/presscorner/detail/en/ip_26_722
🔗 https://ec.europa.eu/commission/presscorner/detail/en/ip_26_723
@HennaVirkkunen How is that to be done without handing these platforms our identities and ability to track us? Seems the last thing I want is for them to be trusted with anything.
@david @bjoreman @HennaVirkkunen that site somehow doesn't seem to work here. But in general, these proposals fail, because sites can regularly probe for age brackets. If you do this on a regular basis, you can figure out someone's birthday.
E.g. if 12 years is a bracket boundary, the day that age gets attested is the birthday of the kid. Even more likely because someone is more likely to check close after their birthday to unlock some site/functionality.
@david @bjoreman @HennaVirkkunen The problem with most age attestations is that you can work out someone's birthday by keeping track of past attestations. When the attestation changes, someone had their birthday, thus the attestation gives away information that someone might not want to reveal.
This gets worse with implementations with which you can test age brackets (different age brackets under 18, to allow some content).
@david @bjoreman @HennaVirkkunen So, the problem with age verification is that it is yet another attack on privacy. Not surprisingly, behind the scenes Meta is pushing this a lot through various sock puppets.
@david @bjoreman @HennaVirkkunen Also, age verification is strongly detrimental to open source and your freedom to choose your OS.
Most implementations of 'anonymous' age verification require remote hardware attestation (eventually), because otherwise you can manipulate the app/process that partakes in the attestation.
Mandatory remote attestation is pretty much the end of free OS choice, because you running your own non-approved software will shut you out of services.
@david @HennaVirkkunen That sounds reasonable-ish. I hope they don't build regulations which create a sea of very poor malicious compliance.
@HennaVirkkunen I think officials should re-examine the unspoken assumption that small children must be hooked up to whatever remote computers.
Car analogies work well in this area. If the Internet is the "information superhighway", then why are parents expecting little Johnny and Susan to play out on the highway? Just a generation ago it would have been framed as abuse and neglect, but now our children must somehow be steeped in the SV wizardry or else they will wither on the vine...?
You're lying as shamelessly as Trump, Putin, Musk, Zuckerberg and all the other US tech fascists.
Dear @EUCommission and @HennaVirkkunen
Please consider what the world wide community of scientists for computer security and privacy, who are studying the impacts of technology on society, have to say on this topic. They published an open letter, signed by more than 400 scientists in the field, calling for a (temporary) moratorium on age verification online earlier this month:
https://csa-scientist-open-letter.org/ageverif-Feb2026
@HennaVirkkunen And what priority has the protection of personal data of adults?
@HennaVirkkunen If some of the companies/services violate/fail laws or rules, you need to sanction them, not violate users privacy. It's that simple.
@HennaVirkkunen I understand all the concerns here, but do we realy want minors to grow up watching 5 dudes in a group r*pe like scene do a young underaged looking woman with pain in her face, urinating on her, thinking that's normal and they have to do or accept this in their later lifes?
Those are contents minors find behind these companies "Are you 18 years old? Klick yes or no!".
This is irresponsible!
@HennaVirkkunen it's interesting that there is almost no commentary or reaction to this on US-centric and controlled Bluesky while quite a bit here on the more European fediverse.
@HennaVirkkunen You don't keep our kids safe by doing this, It's the opposite. That's sad for EU
@HennaVirkkunen M.me commissioner, little by little these companies are forcing age verification systems down to the operating systems. At that point, literally everything done on that computer/phone can be traced back to the ID card used for the verification, it does not matter how sophisticated the protocol may look like.
This is worrisome for many people.
*Ugh*
Please not another excuse for why "handing over all your personal information and ID documents to random Internet services is good actually" 🙄
Forcing consumers to reveal their identity to data abusers keeps no one safe, not children, not adults. Breaking and bypassing privacy technology actively makes the Internet less safe. Curtail data brokers and abusive targeted ad industry, regulate and monitor what GDPR already legislated.
@HennaVirkkunen
@HennaVirkkunen personally I don't think age verification is something that works. It's like putting speedbumps on the highway because a few are driving too fast. Parents should educate their kids on how to use the internet. I would love to see more investigations on products our kids use that see show our kids stuff they should not see
@HennaVirkkunen How do you suggest the platforms should do that? The lazy way everybody around pushes results in the platforms storing huge ammouts of data with government issued IDs. If you don't trust them with child protection, do you really trust them to keep that data private, not leak them and not misuse them?
So please, really think through the next steps. Cause so far I see only really stupid solutions for this issue, resulting in weakening privacy in the name of protecting children.
@HennaVirkkunen how exactly these platforms should identify minors? And what would prevent minors from using a VPN to connect from a country that doesn't put such restrictions? Also, let's say you target the big players and VPNs are not a thing: how much time does it take to people to migrate to other less known porn sites, potentially being exposed to higher risks (e.g. viruses)?
Are you suggesting it would be safe for EU citizens to submit their passport details to services like PornHub?
I think the sentiment is good but for age verification to work it needs to be provided as a service on EU/local governmental level to not leak sensitive information.
Unfortunatly not all countries have the faith in their goverment the same way we in Finland have, and in some cases for good reason, so age verification will be tricky to implement.
@EUCommission If you *really* care about open source, please end Google's use of remote attestation (through Play Integrity) to push open source competitors out of the market.
I can understand that banks and governments want remote attestation, but it should be open to all players, not Google, nor a company cartel.