As I have written in another comment the age verification is supposed to be done anonymously, but also gauging from the comments here noone (including me) seems to understand how.
There are multiple schemes that can be implemented correctly, and are pretty classical.
This doesn’t change that (a) there is a bunch of deeper issues with the regulation, (b) the solutions can be implemented correctly but won’t be.
Like, aiming for actual open-source (not the attestation thing which inevitable ends up with impossibiltiy to change even the UI), an application could hold credentials that also allow something sufficiently annoying (it’s a digital wallet after all) like submitting an address change notification or something. There is a certificate that those credentials are real from a well-known public authority. The server sends a timestamped challenge, the application signs it with its moderately powerful key but doesn’t reveal the signature; instead it verifies the signature chain (authority → certificate/local-key → challenge), observes success and constructs a zero-knowledge argument of having seen this succesful computation.
Basically you don’t want to leave this unattended and talking to open internet (the credentials are real), and you cannot pre-sign tokens and share them, but what server receives has the same probability distribution for all users (assuming not too broken local random generators…), and forging the zero-knowledge argument is a real cryptoanalysis advance.
Instead of all that, of course they will do duopoly-friendly integrity attestation, of course it will be forgeable on any device that can pass integrity check but has a local root vulnerability, and of course it will leak data in a way that Google and Apple will collect.
Which is eclipsed by the entire thing serving to isolate vulnerable kids, of course.
As I have written in another comment the age verification is supposed to be done anonymously, but also gauging from the comments here noone (including me) seems to understand how.
score 1 · canonical
There are multiple schemes that can be implemented correctly, and are pretty classical.
This doesn’t change that (a) there is a bunch of deeper issues with the regulation, (b) the solutions can be implemented correctly but won’t be.
Like, aiming for actual open-source (not the attestation thing which inevitable ends up with impossibiltiy to change even the UI), an application could hold credentials that also allow something sufficiently annoying (it’s a digital wallet after all) like submitting an address change notification or something. There is a certificate that those credentials are real from a well-known public authority. The server sends a timestamped challenge, the application signs it with its moderately powerful key but doesn’t reveal the signature; instead it verifies the signature chain (authority → certificate/local-key → challenge), observes success and constructs a zero-knowledge argument of having seen this succesful computation.
Basically you don’t want to leave this unattended and talking to open internet (the credentials are real), and you cannot pre-sign tokens and share them, but what server receives has the same probability distribution for all users (assuming not too broken local random generators…), and forging the zero-knowledge argument is a real cryptoanalysis advance.
Instead of all that, of course they will do duopoly-friendly integrity attestation, of course it will be forgeable on any device that can pass integrity check but has a local root vulnerability, and of course it will leak data in a way that Google and Apple will collect.
Which is eclipsed by the entire thing serving to isolate vulnerable kids, of course.
score 1 · canonical