To Enforce Its Proposed Social Media Ban for 450 Million Pre-Teens, EU Builds an Open Source App (reuters.com) 136
The European Commission "proposed on Thursday banning children under 13 from social media, with parent-supervised accounts until 15," reports Reuters.
"Enforcement would rely on a tool Brussels built itself" — a free, open-source age verification smartphone app "that tells a platform whether a user meets an age threshold without revealing their identity..." If passed, the proposed Kids Act would create the world's largest social media access restriction, covering 450 million people across 27 countries... [The EU-built age-verification app] is being rolled out through member states, with seven pilot countries: Cyprus, Denmark, France, Greece, Ireland, Italy and Spain. The Commission expects EU-wide availability by the end of 2026.
It will also be used to prove users are over 18 when accessing adult sites, a restriction already implemented under the Digital Services Act...
[T]he system itself is decentralised. Member states run it through issuers they designate, and the proofs live on the user's phone. There is no central EU database of ages or of who verified whom... A user proves their age once to a nationally designated issuer — a body vetted by the member state, which can be a digital ID provider, a bank or a post office. At a restricted site, the app certifies that the user is above the required age threshold. The platform receives only a yes-or-no response. Issuance and verification are handled by separate entities. The proof provider is not told which service the proof was used for. Each proof works only once, preventing cross-service tracking. No identity documents or biometric data are retained. The code is open-source, allowing independent scrutiny.
The significance of the EU approach is that it provides a common age-verification mechanism rather than leaving individual platforms to develop and enforce their own systems. "Online platforms can easily rely on our age verification app. So there are no more excuses," [EU Commission President Ursula] von der Leyen said...
The proposal must be approved by EU member states and the European Parliament before becoming law.
Non-compliance would risk fines of up to 6% of a tech company's global annual sales, plus supervisory fees, Reuters reported earlier. The EU's plan follows similar initiatives in Australia, Britain, China, India, Turkey and several European Union countries.
"Enforcement would rely on a tool Brussels built itself" — a free, open-source age verification smartphone app "that tells a platform whether a user meets an age threshold without revealing their identity..." If passed, the proposed Kids Act would create the world's largest social media access restriction, covering 450 million people across 27 countries... [The EU-built age-verification app] is being rolled out through member states, with seven pilot countries: Cyprus, Denmark, France, Greece, Ireland, Italy and Spain. The Commission expects EU-wide availability by the end of 2026.
It will also be used to prove users are over 18 when accessing adult sites, a restriction already implemented under the Digital Services Act...
[T]he system itself is decentralised. Member states run it through issuers they designate, and the proofs live on the user's phone. There is no central EU database of ages or of who verified whom... A user proves their age once to a nationally designated issuer — a body vetted by the member state, which can be a digital ID provider, a bank or a post office. At a restricted site, the app certifies that the user is above the required age threshold. The platform receives only a yes-or-no response. Issuance and verification are handled by separate entities. The proof provider is not told which service the proof was used for. Each proof works only once, preventing cross-service tracking. No identity documents or biometric data are retained. The code is open-source, allowing independent scrutiny.
The significance of the EU approach is that it provides a common age-verification mechanism rather than leaving individual platforms to develop and enforce their own systems. "Online platforms can easily rely on our age verification app. So there are no more excuses," [EU Commission President Ursula] von der Leyen said...
The proposal must be approved by EU member states and the European Parliament before becoming law.
Non-compliance would risk fines of up to 6% of a tech company's global annual sales, plus supervisory fees, Reuters reported earlier. The EU's plan follows similar initiatives in Australia, Britain, China, India, Turkey and several European Union countries.
Have they heard of a PC? (Score:3)
Re:Have they heard of a PC? (Score:5, Insightful)
The same way your online banking website runs on your PC but verifies your login via an app. App based digital handshakes are a thing, not just for 2FA, but for all sorts of certifications.
Remember you're using a service, the service is responsible for implementing it. I suspect social media sites being social media sites will simply get users to use the app on their phone once or handshake via a QR code.
Re: (Score:3)
The same way your online banking website runs on your PC but verifies your login via an app.
Does it? I regularly access my accounts on five different UK banks from my Raspberry Pi and I don't use an App to verify on any of them. Perhaps it is different in other countries. I sometimes have to receive an access code sent to my phone (an old feature phone) via SMS, but that's it. I also have a gadget which a couple of the banks sent me where I install my debit card, enter the PIN and then it gives me a one-time code, but I haven't needed to use that for some time.
My 80 year old mother-in-law liv
Re:Have they heard of a PC? (Score:4, Informative)
It's standard here in Iceland. *Everything* verifies via the phone, using the same authorization mechanism (SIM-based wireless PKI). The service sends out a special-coded SMS, which gets intercepted and routed to a SIM that has cryptographic applet flashed into it, which triggers a system-level authorization popup for you to confirm (the popup displays a verification code which was included by the site, so you see the same code on both the site and your popup), and which you can then confirm (with your PIN) or reject.
Re: (Score:3)
Does it? I regularly access my accounts on five different UK banks from my Raspberry Pi and I don't use an App to verify on any of them.
You need 2FA since EU directive "PSD2" from 2015 (since then, the EU has updated to PSD3). It was implemented in the UK and requires "Strong customer identification" https://sprintlaw.co.uk/articl... [sprintlaw.co.uk] However, it is possible that the UK legal implementation imposed 2FA only for payment (money getting out of your account) and maybe not for consulting your balance.
Re: (Score:2)
Does it? I regularly access my accounts on five different UK banks from my Raspberry Pi and I don't use an App to verify on any of them.
You need 2FA since EU directive "PSD2" from 2015 (since then, the EU has updated to PSD3). It was implemented in the UK and requires "Strong customer identification". However, it is possible that the UK legal implementation imposed 2FA only for payment (money getting out of your account) and maybe not for consulting your balance.
So, to repeat, this is with five different banks (OK, one of these of the Government run National Savings and Investments) and in most cases, if I want to check balances or transfer modest amounts of money to people I have sent money to before then I only need my password. I only need the SMS mechanism for things like setting up new payees. Perhaps this does count as "2FA" - the password and the phone? I have no doubt that if I had the relevant bank's "Apps" then this may well provide an alternative. In
Re: (Score:3)
A code received by SMS counts as 2FA, so that can be your way out of apps for now.
Re:Have they heard of a PC? (Score:4, Interesting)
>"regularly access my accounts on five different UK banks from my Raspberry Pi and I don't use an App to verify on any of them."
Topic shift, but.... I believe this is why so many companies have fought against TOTP. They want to FORCE you to use their proprietary "app" so they have full control over you. Walmart JUST DID THIS. I can no longer order online with Walmart because they stopped supporting 2FA with Email. I will not use their spy app, and I will not give them access to my phone number because I don't want to be spammed or have it sold to others who will spam me. And they refuse to support TOTP, which would work on ANY device, on ANY platform, with near zero cost, with 100% no tracking, zero potential for additional spam channels, and work even without a network connection or 4/5G connection. Consumers should be fighting back hard on this.
Re: (Score:2)
Re: (Score:3)
TreasuryDirect.gov , where you buy treasury bills and what not, just started letting people sign in with this method and I want to say it will be required before the years end, if not sooner.
Re: (Score:2)
The problem with TOTP is that if it was allowed there would be a lot of fake TOTP apps appearing, which steal your secrets. Email is bad because people never log out of it, where as your banking app probably times out after a few minutes of inactivity.
Re: (Score:2)
>"The problem with TOTP is that if it was allowed there would be a lot of fake TOTP apps appearing, which steal your secrets."
This is why I use only open-source TOTP programs that also have high ratings and trust. The one I recommend is Stratum:
https://play.google.com/store/... [google.com]
Companies could also make recommendations to users when they set up their TOTP 2FA. Even including direct links.
Re: (Score:2)
The problem with TOTP is that if it was allowed there would be a lot of fake TOTP apps appearing, which steal your secrets.
What do you mean "if that was allowed?" TOTP is ubiquitous across many MANY services and apps. The fact that major social media sites push you down this path means that if wide spread faking of TOTP were an issue, it'd would be an issue by now.
Re: (Score:2)
Sure, but banks care far more about your money being stolen than Facebook does about your account being hijacked.
Re: (Score:2)
FWIW I have accounts at maybe 7 banks at the moment and zero of them let me use a third party TOTP, I assume for this reason.
Re: (Score:2)
No, the reason is time. Most banks had mobile phone apps / authentication mechanism that pre-dated third party TOTP systems. There are plenty of young banks or newer financial institutions out there that very much do use 3rd party TOTP as part of the authentication system. I have 2 banks and 5 financial institutions (2 share trading platforms and my pension fund) that use TOTP.
I do have 3 other banks that don't, but then they were doing TOTP before Google tried to make it cool. In fact all three of them his
Re: (Score:2)
The thing to steal is the secret that is used to generate the code. Then the attacker can generate their own TOTP codes whenever they like.
I don't think any UK banks offer it, but I could be wrong.
Re: (Score:2)
What TOTP app is already installed on everyone's phone?
Re: (Score:2)
All Google phones and Samsung devices come with Google Authenticator on it. Virtually all work provided devices come with Microsoft Authenticator on them thanks to Microslop dependency. All iPhones are shipped with the Passwords app which does TOTP on Apple devices.
Also I can tell you've never actually used any of this. Literally 100% of services when you click a setup button will direct you to one of the three above right on the setup screen of the service itself. They are ubiquitous to the point where I q
Re: (Score:2)
Is that right? I couldn't find any confirmation of it, but I suppose it's possible. I have a Pixel phone but didn't notice what was pre-installed as I immediately installed my usual apps anyway.
FWIW I no longer have Google Authenticator installed, and usually you can't completely remove pre-installed apps on Pixels.
Re: (Score:3)
Time-based One Time Password. You and the server have a copy of a shared secret. The secret combined with the current UTC time (in blocks of 30 seconds typically) is hashed to produce a 4 digit code that you enter as a second authentication factor. Without the secret, even knowing the current TOTP code isn't enough for you to predict future ones.
Re: (Score:2)
I store my TOTP secrets in Bitwarden for less-sensitive stuff or on my Yubikey directly for more-sensitive stuff.
Re: (Score:2)
>"regularly access my accounts on five different UK banks from my Raspberry Pi and I don't use an App to verify on any of them."
Topic shift, but.... I believe this is why so many companies have fought against TOTP. They want to FORCE you to use their proprietary "app" so they have full control over you. Walmart JUST DID THIS. I can no longer order online with Walmart because they stopped supporting 2FA with Email. I will not use their spy app, and I will not give them access to my phone number because I don't want to be spammed or have it sold to others who will spam me. And they refuse to support TOTP, which would work on ANY device, on ANY platform, with near zero cost, with 100% no tracking, zero potential for additional spam channels, and work even without a network connection or 4/5G connection. Consumers should be fighting back hard on this.
Top Of The Pops must have made many enemies over the years (and not just because of Jimmy Saville).
Jokes aside, this is largely an American problem as companies there are permitted to be as abusive as they like.
If a store tried to force me to use their app and refused to take an order via their web site they'd lose an absolute shitload of business (not just from me). Same with banks, however there are laws with banks that mean they must meet standards of accessibility and forcing people into a proprie
Re: (Score:2)
>"Jokes aside, this is largely an American problem as companies there are permitted to be as abusive as they like."
Consumers have a lot of power. Note I didn't call for the government to do anything. I called from consumers to reject it.
>"If a store tried to force me to use their app and refused to take an order via their web site"
They will take an order via web site. But only if you give them your phone number for 2FA. That is the issue. I don't want to do that.
>" My bank still uses a OTP sen
Re: (Score:2)
Does it? I regularly access my accounts on five different UK banks from my Raspberry Pi and I don't use an App to verify on any of them.
Congrats to you and your bank? I regularly access my bank from all sorts of web based devices and I log in with a QR handshake using a mobile app. Just because YOUR bank doesn't use a certain method doesn't mean the method doesn't exist.
My 80 year old mother-in-law lives in the EU and regularly accesses social media from her Windows PC. I don't think that she owns a smart phone either so she is going to be particularly irritated by this new imposition.
I've mixed feelings about your comment. On the one side we're starting to approach a society where access to services is increasingly required to be done via a smartphone / tablet device. Not doing so is an actual burden on users who have limited functionality (e.g. accessin
Re: (Score:2)
Re: (Score:2)
My Spanish bank this year forced me to install their app for verification because they discontinued the receipt of an SMS for the second factor. I am not amused: SMS works, but seemingly every other time I launch the app to verify an online credit card payment it insists on updating before it will let me do anything, and meanwhile there's a Verified By Visa timer ticking down.
Re: (Score:2)
"QR" code on screen (a RGB using code works better) mobile phone app sends confirmation with data from the code.
Re: (Score:2)
It doesn't. Even on Android phones, it requires Play Integrity. Most of the problems with social media are caused by monopolistic megacorps, and the "solution" is to give said megacorps even more power.
Re: (Score:2)
Link [github.com], because it didn't work the first time.
Re: (Score:2)
Re: Have they heard of a PC? (Score:2)
In this case, a bunch of postal workers are going to get a serious side hustle.
Re: (Score:2)
Is this a real question? Deep links work on windows, so a trivial way to make this work would be to put it on an oauth claim and just use the protocol as designed.
Re: (Score:2)
Re: (Score:2)
, everyone is trying to force 100% phone adoption. There must be some vast extra attack surface on phones that desktops don't have
It's the contrary, it's that phones are locked down and therefore "secure" in some sense. The attack surface to tamper with the phone OS (without being detected) is small, making it hard to cheat for identity attestation.
Not completely safe (Score:3)
>"The platform receives only a yes-or-no response. Issuance and verification are handled by separate entities. The proof provider is not told which service the proof was used for."
And yet you still have to trust that this system doesn't get back-doored by three-letter agencies. Because if they do, then, suddenly, they have WAY more power than before.... now able to track where EVERYONE goes. And that is down to the individual level with confidence, not just an IP address or guess.
This gives the "yes/no" entity the power to completely shut down any person's ability to do anything meaningful online if they are able to match a device to a certificate with other means, and directed to do so by the government or some other powerful organization.
And it gives this cabal the ability to shut all sites/services out of the market they don't "like." Requiring they all use this yes/no entity and then refusing participation. (Granted, they kinda already have the option of mucking with DNS and ISP's).
And how are open source projects going to be forced to use the system? And why should they? Perhaps you can get coverage by the major sites and devices, but it won't cover the freedom-loving projects nor the shady sites/projects who simply won't use the system. Minors will have full access there. And all it takes is recompiling an open-source browser, IM, VOIP client, whatever, to issue a bunch of vetted "adult" certificates from a nefarious collection of them online, and now you have full access. And you also set off a war between legit users and the "system" trying to blacklist compromised certificates/identities... which, meanwhile, RUINS the lives of those who had their certificates/identities "stolen."
I am certain there are other issues smarter people than me could find with this arrangement. It could be worse, for sure, but...
Why not stop this madness and focus on PARENTS? Firstly, not giving unrestricted devices to minors. Secondly, having PARENTS be in the driver's seat to control what sites/people/services are allowed for their children. Thirdly, supporting a voluntary age appropriate tag for sites/systems that can be used by local device whilelists by the parents. And fourthly, changing the social norms that it is not OK for minors to have unrestricted devices anywhere. Then adults are not impacted at all. And most of the burden falls on the actual responsible party, who should have intimate knowledge about what is or isn't appropriate at their children's developmental stage.
Re:Not completely safe (Score:5, Interesting)
My kids have time limits on their smartphone and the tv. All they need is an "external impulse" that says stop. For the TV, it is a simple stopwatch. Very easy to manipulate. Oh and they do, especially if they want to binge-watch a new netflix series. I could go for a more robust technical solution. I won't. The whole process is exactly what they need. Fail, retry. Reflect, negotiate a bit more time, succeed with good reasons, fail when they are making up excuses... This way, you let the human reprogram itself. Way better than yet another app that controls behavior. Sucks
Re: (Score:2)
Re: (Score:2)
>"I was expecting these types of comments. It is a typical programmer mindset. I have it myself. Sure it is a leaky solution, but when trying to push humanity in a direction, you need to look at it statistically. If it changes the behavior of more than 25% of the people, it is nice. 50% is great. 75% is astonishing,"
Oh, I know. I actually have to defend my position on empowering parents and making THEM responsible for THEIR children on the same basis. I get comments that kids could go to their neighbor
Re: (Score:2)
and simple to express:
Err
and err
and err again
but less
and less
and less.</i>
â€" Piet Heinâ€S
Re:Not completely safe (Score:4, Interesting)
And yet you still have to trust that this system doesn't get back-doored by three-letter agencies.
The "three-letter agencies" discover no new information here. They ALREADY know your name, date of birth, browsing history, online purchase history.
This gives the "yes/no" entity the power to completely shut down any person's ability to do anything meaningful online
Nothing new. The entity is under the same regulatory framework as your bank or your ISP, which already can shutdown your abilities of doing things. It's just another, very limited channel where a bug or intentional action can restrict your abilities to buy liquor and dildos.
And it gives this cabal the ability to shut all sites/services out of the market they don't "like." Requiring they all use this yes/no entity and then refusing participation. (Granted, they kinda already have the option of mucking with DNS and ISP's).
Besides your acknowledgement that they already had the DNS option, the whole "can shot down" doe snot make much sense to me. We are talking about age-restricted businesses doing business in the EU, which are already subject to many rules. If you run a casino or sex shop business in Europe, you already decided to abide by those rules. Those who don't want to obey rules are already subject to whatever systems to block them. The new system does not add anything new. Who would be stupid enough to run a successful online casino, obey by all EU rules until now, then suddenly decide "I don't want to do the age verification thing [because I'm suddenly more libertarian than yesterday]?"
Why not stop this madness and focus on PARENTS?
The European approach has always been, in any problem, to make the burden lie on the business side. In this instance, don't let corporates exploit young people. If some people (children) find workarounds, that's fine, and something we have to live with. But businesses are required to make their best effort to limit the possibility of workarounds.
Re: (Score:2)
>"The European approach has always been, in any problem, to make the burden lie on the business side."
Or the government.
But, agreed. And the USA approach has always been (or at least used to be) to look towards the parents, family, and community, not the government or businesses. Which is why there will (hopefully) be more pushback here.
Re: (Score:2)
Which is why there will (hopefully) be more pushback here.
You should wish for more pushback because the USA's implementation will be rubbish, outsourced to the dumbest bidder, and the government is actively out to get you, not because it's fundamentally a bad idea.
How's parenting going for you guys by the way? Keeping your school shootings down? Has it helped you rise up in education stats? Is your child mortality rate still the lowest among the west, or helped you guys solve obesity yet without medicating kids?
Parents are fucking useless at protecting kids from b
Re: (Score:2)
And yet you still have to trust that this system doesn't get back-doored by three-letter agencies.
Congratulations, you just described electronics. I hope you made this post via telegram and got someone to type it into a burner laptop from an internet cafe, otherwise you may be being watched by the boggieman.
Re: (Score:2)
That's not how it works, there is no way it would create a list of places you have verified yourself to, there is nothing to steal.
Android and iOS already have systems like this for apps that require security, such as some banking ones. The app can ask the OS to check that it has not been tampered with. People who root/jailbreak often find that such apps stop working.
Nothing is recorded, it's just an API call that returns a yes/no response to the question "is the system in a secure state?"
Similarly, the EU'
Re: (Score:2)
How is this different to fake Id. cards or counterfeit money? There will always be someone falsifying an identity. Are you going to bite every coin to ensure it's not a fake (and suffer lead poisoning if fake money is common)? Or, shine a UV light on every dollar bill?
When almost-smart phones first appeared, retailers offered child-friendly phones at twice the price. It became cheaper to give the child an older, full access device but as the horror stories revealed, not better. While parents should be
Re: (Score:2)
This gives the "yes/no" entity the power to completely shut down any person's ability to do anything meaningful online if they are able to match a device to a certificate with other means, and directed to do so by the government or some other powerful organization.
This is the real problem with these systems. Just as Flock, a non-government system, can be misused to throw you in jail.
Wife was fascinated with the exchange at home (Score:2)
(son's voice): Herr Fatherland?
(husband's voice): Ich bin gleich bei dir, mein Junge
Wife: "What's going on?"
Husband: He wants me to log in to an adult site
Wife: Oh.
Why not build a social media app? (Score:2)
Instead of a ban, why not have an open source, social media app that is certificate based and allows each geographic region to dictate policies for the app on their turf, with the app using GPS coordinates and maybe other authentication methods to reduce spoofing? Yes, it would have boundaries in place (keep 18+ who are not family away from those below 18+, have geographic regions fenced off from each other), but why not offer something.
Outright bans don't help. However, having alternatives that do the sa
Re: (Score:2)
There's a million things wrong with this idea, but to me the two most obvious are, why would anyone use a social media app nobody else uses? And who would have control over this app?
Re: (Score:2)
Winos as bypass - ? (Score:2)
Re: (Score:2)
The risk was identified in the threat model as "Cheating during enrolment: A minor obtains a genuine "over 18" proof by cheating at the start: using a borrowed, forged or stolen identity document, or defeating the face check with a photo, mask or deepfake." The risk was accepted with the following comment: "Accepted given the bounded consequence (an "over 18" boolean, not an identity), the 3-month re-check, and continuing improvement of detection technology. Deployments should track the presentation-attack-
Re: (Score:2)
That's reasonable (and the 3 month re-check is not), because you can't solve this problem at all. Even with frequent reverification, and adult and a child can just share an account and the adult reverifies as soon as prompted. You won't reach perfection ever, as this would require perfect cooperation and everyone agreeing on the goal. And in case everyone agreed on it, you wouldn't need the verification either.
Re: (Score:2)
Also, more advanced threat 22: "An adult enrols with their own identity on a minor's phone or passes the enrolment credentials to it, so that the minor holds a batch of valid "over 18" proofs and can pass age checks independently, without the adult being involved in each check."
Comment: "This is the provisioning form of the collusion risk accepted in T-08: a willing adult can always give a minor access, whether per check, per batch, or by lending credentials. Closing it would require binding each presentati
The stupidity increases (Score:3)
Kids are smart and good at finding workarounds
Banning something makes it more desirable
It also trains kids to hate the government at an early age
Completely wrong approach (Score:3)
This is the wrong approach. Social media is just as dangerous for adults as it is for kids.
We need to ban the current social media business models for everyone. That means: No advertising allowed; only show content from people or groups you actually follow; show content strictly in descending chronological order; do not allow sponsored content; charge people to have an account (Facebook probably makes around $3-$5/month/user, so that's a good benchmark.)
Also: Any sort of age verification as described still gives sites an oracle to let them determine the likely age of a user. If you insist on preventing people from seeing content based on age, the decision must be made purely on the client side. That is, the client will pull down the content as usual, but just not show it. That way, the Web site has no oracle with which to determine the age of the user.
Re: (Score:2)
Drugs and booze are just as dangerous for adults as kids. We assume that for a subset of these, adults have the maturity and judgement to regulate their own use. Not always a valid assumption, but what else are we going to do? Go through another prohibition?
Re: (Score:3)
Drugs and booze typically are regulated, to some extent, even for adults.
And I'm not proposing completely banning social media. Just regulating it for everyone to make it less dangerous.
To use one of your analogies: We carefully regulate the purity and safety of over-the-counter drugs. We need to do the same for social media.
Re: (Score:2)
We carefully regulate the purity and safety of over-the-counter drugs. We need to do the same for social media.
The manufacturers of social media content is the public. I'd hate to see how the regulations would affect First Amendment rights. And who we'd get to be the lab rats for testing safety and efficacy.
Re: (Score:2)
Nothing affects Freedom of Expression rights. I'm talking about regulating the business models of corporations, not censoring what people are allowed to say online.
The difference is that people who say inflammatory things online won't get the benefit of an "engagement"-based algorithm to boost their speech. And a right of "getting your expression boosted" is certainly not anywhere in the Constitution.
Re: (Score:2)
The 'manufacturers' (apt word) of social media content are largely corporations and political pressure groups. The fact that they have successfully dressed the content up to make you think it's come from individual citizens posting solely their own thoughts is exactly the problem. Most posts need a big 'I have a financial interest in you believing this' stamp on them.
Re: (Score:2)
The EU is also proposing to allow everyone to opt out of algorithmic feeds, and IIRC for infinite scroll to be opt-in.
There will still be ads, but the feed will otherwise be chronological, or random.
Re: (Score:2)
It should not be opt-in. Reverse-chronological should be the only permissible way to operate. That way, when you know you've seen something before, you also know you've seen everything following it before and you can stop scrolling.
Re: (Score:2)
This is the wrong approach. Social media is just as dangerous for adults as it is for kids.
This is the elephant in the room that no-one wants to talk about, especially those who are benefitting from it.
Social media isn't just targetting kids, they're targetting everyone and it's not just the under 16 who are vulnerable. Loads of adults are as well, in particular the elderly. Social media is radicalising a large number of older people as well. If we're going to restrict SM for younger people, we should also be doing it for the older people who are just as susceptible to propaganda and misinform
Hardly, we are 450 million TOTAL! (Score:2)
And I doubt that we are all pre-teens, I wish, I'm 70.
Re: (Score:2)
Good catch. Officially, 0-14 are 14.2% of the population https://ec.europa.eu/eurostat/... [europa.eu]
How helpful (Score:2)
It would make more sense to have a EU made - if you want 100% government controlled - social network for kids.
The kids will circumvent this bullshit anyway. And if I was a parent I would make my child a fake account, just like most parents will do.
What the fark is wrong with having an FB account or a TikTok account that shows you people from all over the world and their culture???
Re: (Score:2)
It would make more sense to have a EU made - if you want 100% government controlled - social network for kids.
Just this clearly isn't an approach compatible with European way of doing things. Your proposal of "100% government controlled", which is the very definition of government overreach. Also, the EU isn't allowed to compete with businesses (by making an app that goes onto the market to compete with TikTok etc.). The government sets the rule for businesses to exist. The rule is: you can make a social network, but you are responsible for making sure no kids are there. It's a simple and reasonable approach, simil
Re: (Score:2)
And why would a child get more toxic content than its parents?
If you click: "not interested" nearly everything you are not interested in: goes away.
90% of the content you get on social media: is from your social friends!!! hence the name.
The rest is advertisement, which the platform/algorithm thinks fits my profile.
On TikTok for example, I get nothing unpleasant at all. It is configured that I only get stuff the algorithm is 100% sure I like, and actually: the algorithm is 99% correct.
If I had kids: for the
End users can't be arsed, this will fail (Score:2)
Re:Goodbye (Score:4, Insightful)
"Member states run it through issuers they designate,"
Say goodbye to online anonymity then.
Except not. The member state's issuers only issue the certificate of certification that doesn't leave your device. The rest of the online world gets a yes/no token. Such systems are implemented in many different ways by member states for other purposes already.
But hey you don't even need to trust anyone about this. The app that sits in the middle of it all is open source. Go read the code yourself.
Re:Goodbye (Score:4, Informative)
Go read the code yourself.
Can I compile it myself, or install it on my GrapheneOS phone? No to both since each country makes its on version and those versions require device attestation.
Re: (Score:2)
Whitelist of SIMs? (Score:2)
Mod parent funny, but it's an old joke.
On the substance of the story, it's fundamentally a whitelist approach, but of course that will create a black market for fake entries in the whitelist. Strangely enough, that may still be acceptable for the primary justification here. Most kids can't afford black market prices, so they will be blocked out as intended.
I've been thinking of the transition point from the other level. Extremely young children have to be protected from self-destruction, but they don't mean
Re: (Score:2)
Can I compile it myself, or install it on my GrapheneOS phone? No to both since each country makes its on version and those versions require device attestation.
The open source tool displays how the protocol functions and allows you to verify the only information sent to the service provider is a token. Given the services are not under the jurisdiction of any one provider you need to be of the belief that either it is just getting the yes/no token, or that they are in cahoots with each individual government separately implementing their secret privacy leaking info. And if you believe that I'm sure you have questions about the FBI's involvement in the trade centre c
Re: (Score:2)
There's an open bug to fix that, but who knows if it will gain any traction.
https://github.com/eu-digital-... [github.com]
Re: Goodbye (Score:3)
Do you have the code for the compiler, and compile that yourself too?...and ditto for THAT compiler? All the way down...
Re: (Score:2)
Diverse double-compiling (Score:2)
Do you have the code for the compiler, and compile that yourself too?
If you have three different compilers for a language, and you bootstrap a compiler using all three of them, the first generation (e.g. GCC compiled with QuestionableCC, ShadyCC, or SlopCC) should be functionally identical, and the second generation (GCC compiled with GCC, which was compiled with the other compiler) should be bit-identical. See "Fully Countering Trusting Trust through Diverse Double-Compiling" by David A. Wheeler. Some people have trouble trusting Rust because only the latest stable rustc ca
Re:Goodbye (Score:5, Insightful)
Except not to you. You're confusing data minimization (the website doesn't get your name from the token) with unlinkability (nobody can connect your activity to your identity). The *token itself* doesn't reveal your identity, but it leaks data in a wide variety of ways.
Even if you browse via a proxy, if the authorization service gets a token directly from your phone, it has now correlated your phone with your proxy-browsed history. A very common means to do secure authentication these days is SIM-based wireless PKI, wheren it has now connected you to your phone number. To governments, it offers a broad range of brand new vectors to correlate you to an identity if you, say, mention you had an abortion or criticize your local strongman leader, since they control the backend infrastructure that establishes the connection between the token and the identity. And not just at signup time every real-world digital credential must be able to be revoked if the phone is lost or stolen, or credentials expire or are revoked. So how does how does the open-source app prove a credential is still valid without "phoning home"? If the app checks a revocation status list, then ISPs, CDNs, or state security services can correlate the exact millisecond of queries to the revocation server with the submission of a verification token to a platform - each time it's submitted. Assuming that they can't just get it with more direct means than timing attacks.
Also, you cannot just "read the code". The frontend is open source, but what is being done on the backend is not. You have no clue what logging polciies, database schemas, operational security, etc the "designated national issuers" or servers handling the credential revocation are using, and what government intrusion has been forced on them. I'd feel a more comfortable if it were all happening from Brussels but handing it over to individual states, some of which at any given point will be authoritarian, is just handing them an easy new vector to unmask people.
As for your "Such systems are implemented in many different ways by member states for other purposes already." - yes, for filing taxes, healthcare, online baking, etc - things that you intend to do and must do under your legal identity. Not for anonymous conversations on the internet. Your argument basically reverts to "But people already do things non-anoymously on the internet , which reinforces my point that yes, this taking something from the "anonymous" category and putting it into the "easily unmasked" category.
If you think this won't be abused, I cannot help you. Not even just abused from a criminal or extrajudicial perspective, but even from a civil one, because orders to unmask someone can be subpoenaed.
in our owners we trust (Score:2)
agreed very much, and valid points, except your faith in brussels is ... surprising? i'm guessing you're thinking about the likes of afd and rn, and there's some legitimate concern there. however ... is an opaque supranational institution ruled by a banking cartel any better? if they can't supress it (and they're trying hard) in no time they will own any "right wing menace" coming up anywhere just the same, so i don't think national political alternatives will mean much except some initial noise, new faces
Re: (Score:3, Insightful)
it has now correlated your phone with your proxy-browsed history.
You're making wild assumptions into the implementation. There's no reason the authorisation service needs to have any information about your network condition. But since we're talking about an open source implementation the actual process can be verified, even if the direct application cannot.
To governments, it offers a broad range of brand new vectors to correlate you to an identity if you, say, mention you had an abortion or criticize your local strongman leader, since they control the backend infrastructure that establishes the connection between the token and the identity.
Yes I agree this system won't work well in shitholes like Russia, China, or the USA, but in the meantime we have actual evidence that the vast majority of European nations which do have privacy rules for citizens find
Re:Goodbye (Score:5, Insightful)
You visit an online liquor store. The store asks your mobile phone whether you are of sufficient age. Your mobile phone asks the issuer, gets a yes/no token, forwards it to the liquor store. No data was leaked.
In countries where the issuer is "the bank", then in any case both the liquor and the bank already knew everything (the online liquor store already knew your payment details, and your bank already knew you make purchases at the online liquor store).
Re: (Score:2)
Re: (Score:3)
The possible collusion between the issuer and a website was identified in the threat model: "A deliberately non-compliant issuer that secretly retains fingerprints could link presentations reported to it. This requires active wrongdoing by a regulated, audited entity (a Trusted-List-registered provider subject to GDPR and national supervision) plus verifier cooperation". https://ageverification.dev/av... [ageverification.dev]
Why would a large, government-designated entity like a bank with or the national Post Office service, use
Re: (Score:2)
If the bank is cooperating with the government to help round up all the scary foreigners and political dissidents labeled as dangers to the people?
Re: (Score:2)
You have trouble conceiving of situations where governments would seek to deanonymize people on social media, are you kidding?
Re: (Score:2)
A nation can obviously make it traceable if it wants, it can also make it untraceable if it wants.
The app can just check your physical ID with NFC offline, set a flag "yep, older than 15" and be done with it.
Re: (Score:2)
The EU app supports offline options, one of them going to an official service (e.g. Post Office) who have an interface to accept requests based on checking your physical ID.
Re: (Score:2)
The overall idea is that this does not need to happen. A simple protocol (not sure if the app adds something on top):
Site: Here is a nonce: abc123+is_adult, please sign.
User: Logs into the government site and inputs the nonce and gets it back signed (given that the user is an adult, otherwise no signature for them)
User: Sends the signed nonce to the website
When the government site and the verifying website do not exchange the nonces seen, the user stays anonymous. I think you can probably also add wrapping
Re: (Score:2)
Did you read the summary? Or even the rest of the paragraph you quoted from?
> [T]he system itself is decentralised. Member states run it through issuers they designate, and the proofs live on the user's phone. There is no central EU database of ages or of who verified whom... A user proves their age once to a nationally designated issuer — a body vetted by the member state, which can be a digital ID provider, a bank or a post office. At a restricted site, the app certifies that the user is above th
Re: (Score:2)
You may want to look at the actual design used here. There has been a real effort to ensure anonymity. Yes, shocking for a government body, I know. But it can happen.
Re: (Score:2, Interesting)
Re: Well .... (Score:5, Insightful)
Failure to achieve perfect compliance is not actually failure. I think anyone with a few braincells knows that a law is not perfect and will not stop every instance of a behavior.
Re:Well .... (Score:5, Insightful)
Slightly paraphrased:
...surely if we can ban criminals that do crimes then we can ban pre-teens from using social media, yes?
We've never let the impossible stop us before!
See how dumb it sounds?
Your point is just another iteration of Montesquieu's "le mieux est l'ennemi du bien" [wikipedia.org] saying. I personally find it particularly tiring. Yes, the proposed solution won't achieve 100% conformance to the ban. Yes, there will be some teens who find methods to circumvent it, there will be stolen credentials and there will be hacks. But it will be a clear improvement of the current status, and will do it without completely destroying the privacy of users. Rejecting the whole thing outright because it won't be perfect is beyond stupid.
Re: (Score:2)
It's funny how there's always a few people going "it won't solve the problem 100% so it's pointless". The goal is to reduce screen time for kids, this will do that.
Re: (Score:2)
Laws are made to be broken.
Re: (Score:2)
What is your problem with her?
She is actually one of the few politicians who has a clear mind and a clear strategy and clear goals: and reaches them.
Re: (Score:2)
now gets to enforce EU-wide what she very prominently failed to do on germany-level
Yeah, nah, that's not remotely how the EU works. Van der Leyen get's to enforce precisely two things: Jack and Shit. EU rules are voted on by representatives of *all* member nations and supervised by democratically elected members of parliament.
The president of the EC can't rule by decree on literally anything. At best she can set a legislative agenda, and even then that needs agreement from member nations.