Brussels launched an age checking app. Hackers took 2 minutes to break it

This is misleading, yet everyone seems to repeat it. Discord's implementation of ID verification did not retain IDs. Reporting on this was so poor, but what appears to have happened was that people that failed age estimation / ID checks had to raise a support ticket and get manually reviewed. That support platform was pwned and the active support tickets were leaked. Who knows how long these support tickets were set to live for, but up to 70,000 active tickets getting leaked feels like a drop in the bucket. It's also not immediately clear to me what the alternative is (other than not getting hacked), when you require human intervention to review problematic IDs. Even if the ID only lived on their server for 24 hours during manual review, across a userbase of >200 million users, that's a lot of IDs at risk at any given moment, especially during these initial roll outs of age verification.

Member states will either fork or redevelop their own apps around the proof-of-concept app. The app on Github that was "hacked" will never be deployed directly and that was never the plan either.

So far, this whole project has been an excellent way to gauge news outlets on whether they're trying to report the news or are just trying to win clicks through FUD and outrage. Most of them don't seem to know what they're writing about when they report about flaws and problems.

The EU on the other hand does not have a common constitution, army etc. so is not a real state (yet). It is made up of soveraign nations who come together debate and decide there, but then it is still up to the members to implement that.

So the transition to the EU as one state is happening, but might never complete.

So while linguistically it's the same system as using 'Washington' or 'Moscow', Brussels is specifically in the bad spot where it gets blamed for impopular stuff but never praised for popular things.

And Brussels is not the capitol of the EU because the EU is not a country.

Look, let's be clear here. The UK (as a member state) was concerned that the EU was becoming too federal. Therefore (following Machievelli) they decided to push for new members, mostly the eastern bloc countries.

Then, politically, it was difficult for them to refuse to allow immigration from those countries (many of the other members had a moratorium for a few years post-accession). This lead to lots of British people becoming very upset, at the EU for some reason (even though their government had done this).

Except that half the time the assembly seats in Strasbourg. https://en.wikipedia.org/wiki/Seat_of_the_European_Parliamen...

The "Brussels" metonym is probably the most ambiguous reference to a government body on the planet.

This is not designed to prevent adults from coöperating with minors; that makes no sense as a design goal because any technical measure can always be bypassed with “download this for me and give me the file”. This is designed to prevent minors from being able to access systems without an adult.

Nothing prevents an adult from buying alcohol on behalf of minors; that doesn’t mean laws that prevent minors from directly buying alcohol are useless.

Multiple accounts must be supported, because e.g. personal and work accounts must be separate to not mix them.

The certificates in question can use a few mitigations: short lived, hardware stored (in a TPM, making distribution harder), be single use, have a random id which the service being accessed can check how many times has been used.

> but then the issuing government and the service providers have a timing side-channel they can use to correlate identities

That's not reallya concern, IMO. That would always exist as a risk - most people would probably have a flow of trying to do something, having to prove ID/age, doing that step, continuing with the something, which means you'd probably be able to time correlate the two sides quite often. The solution here is legal with strong barriers, not technical.

Basically you can prove that you have an identification document and that a certain property is true without revealing anything else.

That doesn't make sense, all IDs are already in a single government database. Kind of by definition in fact, for IDs to be useful they need to be emitted by a central authority with associated security and revokability guarantees.

The implementations I've seen rely on an app reading your physical ID and its NFC chip, comparing that with a selfie to ensure it's the same person, and being able to provide anonymous proof you are of age based on that, or proof that you are indeed who you say you are.

The article links to the source code repository here:

https://github.com/eu-digital-identity-wallet/av-app-android...

That links to the tech spec:

> The solution leverages the existing eIDAS infrastructure, including eIDAS nodes and the trust framework for trusted services, to ensure a high level of security and reliability. By aligning with the technical architecture of the EU Digital Identity Wallet ARF, the solution delivers secure, reusable, and interoperable proofs of age.

> The solution enables users to present their Proof of Age attestation to Relying Parties, primarily for online use cases. The system is optimised for secure and privacy-preserving online presentation, allowing users to prove their eligibility without disclosing unnecessary personal information.

— https://github.com/eu-digital-identity-wallet/av-doc-technic...

Annex A includes details on the ZKP:

> AVI SHOULD support the generation of Zero-Knowledge Proofs using the solution detailed in: "Matteo Frigo and abhi shelat, Anonymous credentials from ECDSA, Cryptology ePrint Archive, Paper 2024/2010, 2024, available at https://eprint.iacr.org/2024/2010".

— https://github.com/eu-digital-identity-wallet/av-doc-technic...

And the linked paper:

> Anonymous digital credentials allow a user to prove possession of an attribute that has been asserted by an identity issuer without revealing any extra information about themselves. For example, a user who has received a digital passport credential can prove their “age is ” without revealing any other attributes such as their name or date of birth.

— https://eprint.iacr.org/2024/2010

And yes, even sending an age bracket exposes the age over time as you can observe a repeat visitor changing brackets and compute the actual age from that. With the server sending the info instead you can't really tell if the browser blocked it, or if the user just didn't navigate further on the page. (The browser still need to fetch all the CSS and other resources though, otherwise that would be possible to tell apart.)

- MUST use either Google or Apple account - must not be banned by the provider or sanctioned in the USA

These issues have been flagged to the devs working on the blueprint since the inception, only to be handwaved away.

Getting banned can happen randomly even if you're not doing anything illegal or wrong (it's enough for a robot to decide you're within the blast radius), getting sanctioned can happen if you're an UN lawyer investigating human rights abuses USA actually likes.

So I do see a problem here.

Or just give parents easy to use parental controls. But that wouldn't grow the surveillance state.

The issue is that a lot of these services wave around a lot of words that _might_ mean that they are reasonably private, but it's damn hard to actually detemine if it is actually working like that in practice (the eIDAS standard seems to suggest the ZKP stuff is entirely optional, for example).

"Some people can't support their health condition, and they should be helped to die". This end of life law is introduced like a care service for people having issue with health with no happy ending at sight.

The reality of the vision of Macron (liberale capitalist) is: All his actions are made to kill public health care, and aims to open the field to private corporate. People in need of bed at hospital are denied (public beds are getting more and more cut). People in need of teams for mental care are denied (public teams are getting more and more cut and overbooked). People in need are juste denied. They cant' pay? great, they can now legally choose death, it will be legal. Next client please. Everyone who can't pay doesn't need to feel a weight on his family/friend. Yay :/

This law is shown like a right of care, all the population can be legally targeted, while they could just have the right of health care and stay alive in decent condition. This could be another solution, but it doesn't meet Macron (and its sponsors) ultra capitalist's vision of open market.

Note: current concerned people are the first to call a big NOPE on this law.

I think you see where I go: I think you're highlighting a true and very important problem (I've worked 10 years with children, i confirm your point), but the current solution brings more issues than what it is supposed to solve, same for Macron's end of life law. Having a problem doesn't mean you have to risk the full society in a Orwellien way.

Sorry im not english speaking native, hope you understand more my feeling ?

1) Obviously you can't be trusted to handle your own ID card, because you could lend it to someone else or manipulate it in some way, so there should be a trusted guard with you at all times to manage your ID card for you and hand it to the shopkeeper.

2) Obviously you can't be trusted not to try to influence or attack your guard, so you must be kept in handcuffs for your own safety.

3) Obviously you can't be trusted with acquiring unapproved tools or meeting unapproved people who might enable you to break out of your handcuffs, so the guard must only allow you to communicate with approved people and buy approved products.

Conveniently and profitably, this also puts the company supplying the guard in a position where they can sell access to their control over you (as a consumer and as a source of experimental data) to their trusted partners.

I love how a lot of the "this is the parents' responsibility" opinion-havers don't seem to remember what it was like to be a kid themselves and / or don't have kids of their own.

This can go into the reader of anybody who e.g. sells beer to pick your example:

  1. Reader knows beer >= 18 because reader is in Germany  
  
  2. Reader asks card to verify >= 18
  
  3. etc.  
  

Self exclusion would still be possible if there is a standard for it.

That's a solved problem and making an immense vulnerability out of it is silly.

Anyway, ultimately it's best effort. No security is flawless, but if it stops 99% or more of cases it's better than 0%.

That's how you sound.

The government already defines what misuse is both for children and adults, defines responsibility for a lot of things even in your cupboard, and has been doing so for as governments have been a thing. And I don’t think you understand what “thought crime” is.

You won’t hear me say this too often but next time use an LLM to write your comments, any LLM will do, can only get better.

The credit card doesn't work as age verification.