> Desktop support is not currently within the project's scope.
What I would like to take from this is that, by their own definition, desktop apps are out of scope for Age Verification. So does that mean we will see a return of the 'desktop applications' instead of everything being a web service ?
One can dream perhaps. Until then adults who are willing to 'do what they're told' will be the ones who are inconvenienced by this constantly.
Edit: Also this will completely disable any new phone OS' being developed. Why would anyone bother when you can't verify your wallet to do anything online.
No. It's still required by law, which means that your desktop application will require some interaction with your smartphone.
One day, there will be a knock on your door.
"Good morning, this is the police. Is there something wrong with your phone? Is your phone broken? Can we provide you with a charge?"
"No, I must have turned it off accidentally."
"Can we assist you with an upgrade? The newer models don't have power buttons."
Tell somebody you use your phone less than 10 minutes a day and look at their face change.
If the actual implementations do copy the dependency on Play Integrity and other such APIs, that does become a problem (getting past that is a major annoyance on amd64 computers because there are so few real amd64 Android devices that can be spoofed).
However, the law regarding these apps specifically states that the use of this app must be optional. I'm not sure websites and services will implement other solutions, but in theory you should not need a phone unless you want the convenience and privacy factor of app verification. I expect alternatives (such as 1 cent payments with credit cards in your name) to stick around, at least until we get a better idea about how this thing will work out in practice.
Wait a minute, while writing this comment, I realized that there was a guy who sort of packaged waydroid into flatpak-ish to run android apps in flatpak.
https://flathub.org/en/apps/net.newpipe.NewPipe
(It uses android translation layer??)
I am not an EU citizen but if somebody is & they want this age verification app on desktop, maybe the best way might be to support this android translation layer to convert this EU app into something that can run through flatpak and then use linux I suppose.
I mean, some of y'all are so talented that I feel like surely someone would do it if things do go this way! So not too much to be worried about I suppose :>
Edit: Sorry that reference was a deep cut, I was quoting the devs of that awful Diablo mobile game way back.
I used to use the messaging app through SMS tho, the people that knew me (that 1 friend gets a shoutout here who used to msg me through SMS in the world of whatsapp and my mom!!)
Most phones are used for two things that my father used to quote: Whatsapp (messaging app) and youtube(social media)
Entertainment could somewhat be offloaded via music player etc. into dumb phones and to be really honest, I think that even things like hackernews could be operated on those dumb phones if given the ability to.
https://www.youtube.com/watch?v=QdYrBpBJRI4 : this is the dumbphone which supports signal btw. Wish there was a way to make app for dumbphones like these just as how we can make apps for androids.
I was shocked by how much feature packed my chinese dumb phone was for 11.27$ lol. It just didn't have internet & yeah games as well.
Idk I created this just right now lol.
But on a serious note, Maybe check out my comment on something known as the android_translation_layer with flatpak to see if that might help to run that app atleast in linux.
Linking it here : https://news.ycombinator.com/item?id=45361397
Don't let perfect be the enemy of good.
Not only that, but having this locked behind something that works for 95% of users means the other 5% will never have enough leverage for any other implementations to be approved. Which is absolutely unacceptable for such an essential feature like age verification.
The target, which are the children who access "forbidden" websites without authorization is likely to be lower than amount of people who won't be able to access due to those narrow specs.
This is a general computing crisis.
Why wouldn't that be sufficient?
Every new secure government identification/authentication/verification thing will try to 'just' use Android/IOS, because 'everyone' has one those smartphones.
It sucks, yes, but that's probably how these people think.
the main reason is that this is not a reference implementations or "this is the app everyone must use" case but a "to see what is technical possible/practical" "research/POV" project
this also makes the "EU age verification app" title quite misleading
Which is a joke when you know that most phones in the wild are using an obsolete OS version (most of the time due to lack of software support from the manufacturer, but sometimes because some people just refuse to update because updates are in fact downgrades — looking at you iOS).
There's a much bigger likelihood of me going back to a feature-phone, compared to me starting to use my phone for anything but the absolute basics.
my commute is a really long ride and I just don't like using my phone in it.
My dumb phone had music system and sd card (I finally managed to have that sd card fixed after an year of using that dumbphone without even an sd card for music)
I just used to stare into nothingness / surrounding and think. (Yes I have edited it because I didn't used to think, I used to overthink just as I am doing right now lol)
Not that productive, but my current phone is so slow that I can't even tell you guys or start telling you. It takes me 1/2 a minute just to unlock it and the only thing its truly good at is having a music player run and some occasional hackernews or pokemon showdown or youtube scrolling.
But tbh, I don't have any banking apps etc. so to me there isn't thaaat much of a difference. I feel like a macbook is genuinely nice as it has that less friction and a pc is great too as compared to a phone for the most part when I am at home.
My screentime is usually just some shorts that I occassionaly watch on phone when I am extremelyyy bored.
I am sad that my dumb phone was in my bag one day and then it just stopped (working??) , I swear I kinda regret having my dad's old phone. I am not sure how he was even using it.
Most of his friends (non-tech people) use only phone (gathered from visiting them and talking to them).
Please get off of your high-horse and actually try to interact with wider world and not the IT bubble :)
Even if you go to statcounter (https://gs.statcounter.com/platform-market-share#monthly-202...) you can see that mobile easily outweights desktop. And most likely those on desktop have mobile as well.
Those with only desktop would be tiny fraction…
That seems pretty rude and uncalled for, why would you say that to me? Do you think that I don't have friends outside of the "IT bubble" myself, or that I don't have my own spouse who is a non-tech person?
The only eventuality where this is acceptable is when desktop computers won't even be gated, and then if anyone can circumvent the problem with a computer, why is anyone even bothering with the whole thing...
That doesn't surprise me at all. Principles in a government body don't exist. They are all crooks.
> combat social exclusion and discrimination
[1] https://european-union.europa.eu/principles-countries-histor...
Every time someone says “they’re all crooks” they are the enablers of crooks. The crooks couldn’t do it without people like that.
Again - this is only just one of the possible implementations of https://ageverification.dev/Technical%20Specification/archit...
It's possible to have others but as POC they are focusing on covering the biggest chunk of the population…
A desktop computer doesn't necessarily have a microphone or camera, and doesn't necessarily have to be connected to the internet. I'd wager most crime, including that which affects children is done on "disconnected devices" in this sense.
Even though it sounds like _you_ probably know this, Cory Doctorow has been sounding this alarm for years. As usual, it seems he was right about the possibility of this being a legitimate battlefront in the (actual, non-hyperbolic) war on freedom.
I mean, otherwise would be like not being bound to speed limits if you don't have a speedometer.
If something doesn't work without your phone, report it being broken. If they tell you to use your phone, tell them you don't have one. If possible, leave their service, if they don't care.
We have to make it their issue as much as possible, when they try to push their shit onto us.
Surprisingly often there is a workable alternative to using ones smart phone. We have to make use of those as much as possible, so that the cost for them to get rid of those options will be high and they think twice before doing that and offending us.
That only works in a world in which the government provides speedometers, which restrict the vehicle automatically, and in this case they refuse to provide them at all for blue cars.
This already the case today, you can't run your bank's app or government eID apps on anything but Google or Apple devices.
I can log in to my bank account using my desktop PC
> government eID apps
I can sign into government websites using my desktop PC and its smart card reader and my government-issued eID smartcard. No smartphone needed.
The biggest issue is that the attestation hardware and the application client is the same device with the same manufacturer, who also happens to have a slight conflict of interest between monetizing customers and preserving any sort of privacy.
IMHO the pro-attestation forces are so overwhelming that we should all cherish the moment while we have anything open left.
That seems completely contrary to the spirit of EU laws and regulations, which tend to be about protecting the consumer, preventing monopolies, ensuring people can generally live their lives where all things that are mandatory are owned and ran by the state and foster a certain degree of EU independence, with a recent focus on "digital sovereignty".
This one is a five for one against all of those goals? Harms the customer (you could see this as the polar opposite of GDPR), strengthens entrenched monopolies, force citizens to be serfs of one of two private corporations in order to access information, and on top of that, like it wasn't enough, willingly capitulates to the US as the arbitrates of who is a valid person or not.
This is so against the spirit of the EU itself that it would almost be funny if people weren't serious.
Because the EU doesn't actually care about privacy, otherwise they wouldn't be trying to do this and ChatControl. They care about being the main ones to spy on you, and maybe using fines as additional "taxes" on rich foreign companies. That's it.
Europe's dependence on American tech is a major pain point but realistically, there are only two smartphone vendors. If a European vendor does rise up, I'm sure whatever app comes out of this process will happily hook into the hardware attestation API for that OS as well.
Because this is being pushed by lobbyists to use hardware attestation to make it piratically mandatory for every citizen in the EU to be registered to either Apple or Google with a real id for all non-trivial online interactions at all times. The people behind this push neither have the technical knowledge nor care in the slightest that this is the consequence.
I am stealing this typo.
It's not an insane question, it just doesn't get asked.
CoPilot+ PCs even require the same security chip as XBox and Azure Sphere IoT board (Pluton), in addition to TPM 2.0.
https://learn.microsoft.com/en-us/windows/security/hardware-...
It’s not the sole reason, but it’s a solid one.
For example, it would be completely fine to implement remote attestation where devices issued by companies to employees verify their TPM values with company's servers when connecting via VPN.
All other such activities directly infringe on ownership rights.
Yeah sure it's guarantees that the device is more or less similar as from the factory... and then what? What am I supposed to do with that information?
You can get PCR values and decide if the device you are talking to is tampered with. That way, you can set a higher bar for hackers.
This is completely different to what this topic is about, I'm just saying that there is a case where it can be useful.
From USBC to ad supported business models, the EU has fairly tight control over how products are designed and monetized, in a way that I don’t think can be described as a pure market economy.
Note that I’m NOT saying their level of centralized control and government specification of product requirements is bad. It’s a legit trade off and there are arguments that some or all of it is enlightened. But it’s certainly not a place where you just build your product and ship it and let the market decide.
Market economies are contrasted with planned economies, i.e. how prices are determined and production allocated, and the EU most decidedly is not that.
If they accept us, of course. Not everyone is Snowden.
Russia is a one way step ahead here, with mandatory pre-installed apps, full-scale internet censorship (still catching up with China, though), mandatory DPI, etc.
And what gets me is that it's not just 'you need a phone', it's 'you need a Google or Apple account'.
not your linux phone with waydroid or fairphone with lineageos
In anycase we all know ways of bypassing this age verification will be found, probably by the kids themselves. But all this will do is enable US big tech, killing the very EU based companies the EU has been crying about for years.
Meta, Twitter, Google and M/S could not have created a better law to protect them then this law.
Card payments and digital banking have closed most bank offices outside the larger cities. Mail dropoff boxes are slowly dying out. Paper bank invoices now cost extra (an unreasonable amount extra).
Granny may be able to verify her age, but the service desk won't necessarily be local.
The discussion has been shifted from "whether age verification should be a thing" to "how to implement a more convenient age verification system."
This has always been a "best effort" initiative that is unlikely to stop "dedicated" users.
What happens if something goes wrong and you have to rely on contacting a human in Google of all places? Sorry, you have a copyright strike on your YouTube account, now you can't file taxes! Hopefully you have enough followers on Twitter than you can get them to pay attention.
- Recital 71, which vaguely suggests minors' privacy and security should be extra-protected, but says that services shouldn't process extra personal data to identify them.
- Article 28, which says that platforms should provide a high level of "privacy, safety, and security of minors", again without processing extra personal data to identify them. It also says that the Commision may "issue guidelines", but says nothing suggesting age verification should be implemented.
- Article 35, which says that "large online platforms" should maybe implement age verification.
Furthermore, recital 57 says that the regulations for online platforms shouldn't apply to micro/small enterprises (which has a definition somewhere). All together, I don't see anything suggesting that anyone but the largest online services is being forced to implement age verification right now.
Judging by various posts by the Commision I've seen online, they're certainly pushing for the situation to be seen this way, but de iure, that's currently not happening.
EDIT: I found the guidelines mentioned [0], and a nice commentary on the age verification parts [1].
[0]: https://digital-strategy.ec.europa.eu/en/library/commission-... [1]: https://dsa-observatory.eu/2025/07/31/do-the-dsa-guidelines-...
If implemented according to plan, things like ID cards, drivers' licenses, diplomas, train tickets, and even payment control can be handled within such apps entirely digitally. Aside from age verification, with attribute based authentication you can prove digitally that you're permitted to drive a certain vehicle without revealing your social security number (equivalent).
A healthy dose of cynicism would make clear that the moment such optional infrastructure is rolled out, new legislation can be drafted to "save on expenses" by enforcing this digital model and "protect the kids/fight the terrorists" by forcing age verification on more businesses.
I'm certainly not against vigilance and making sure no new laws mandating the use of either this or the full digital wallet sneak through, but my point is that, despite the Commision's misleading public stance, age verification is (mostly) not mandatory today.
The README for the age verification spec specifically calls out article 28 of the DSA and the Louvain-la-Neuve Declaration. Neither is aiming to be the mandated age verification mechanism for every single website, but rather a specific tool to solve a specific problem: age limits on social media and big tech websites.
If, or, seeing Denmark's recent bullshit: when, we do get mandatory age requirements, it'll be part of new legislation that will likely take years to go into effect, and, seeing how long it took websites to comply with the GDPR, will start affecting most websites even later. This isn't the doomsday law that I would've expected to come from the US if they were to write something like this, and using privacy-first cryptography does give me some faint hope that this isn't just a big performance to hide malicious intent. This could've been as bad as eIDAS 2.0 with the QACs and other unreasonable technical requirements.
_Can_ be handled? So you could still just use traditional physical, paper IDs?
That doesn't make sense because the government knows about every vehicle and its owner and his social security number and there is no point to hide it. I think you misunderstood something or I misunderstood your comment.
The goal of "bringing identity to your phone" is making identification easier to require it in more cases so that the government knows better what its citizens do. One thing if you are required to fill a 20 fields form to buy a bicycle and another thing if you need just to tap your phone at the cash register.
- this project is just one implementation (POC if you want) - they simply state the current scope of the project
For anyone sane managing projects it makes sense to correctly allocate resources that would cover the most people.
and to all those whining butthurt individuals here - reality check is that it's way more probable that someone has and uses a smartphone than a computer. go out of your tiny bubbles...
And plenty of people, including myself, thought "this is so dystopian it couldn't possibly happen".
It did happen, and it's as bad as the doomsayers said it would be.
At this point I don't find it impossible that critics or other "enemies" of US (or Israel) in Europe will get their phones bricked as sanctions, and as a result become second class citizens.
I don't even see the necessity for having hardware attestation. We've had for decades online ID systems that can you can run on any device with an internet connection.
But think of the children, right?
I have very little hope, that the common user will make use of their own agency avoiding a dystopia, or even think about issues associated with their behavior. We can see this everywhere even today. The majority of people are clueless and just accept whatever bone is thrown their way. Need to buy a new phone every year now? OK. Pressured to accept digital surveillance by not even state agencies but private profit oriented companies, that want to sell your data or use it for nefarious purposes? OK. Giving all your communication data to big tech? OK. ... It is all just a big "auto-accept any digital rape" for most people, as they don't even want to think about the technical implications and implications for society. It's all so far above their technological understanding, that they just exit the bus, when it comes to discussing these things. That is the problem we face. How to make the normal person aware and interested in their own digital rights.
My optimistic brain is hopeful for federated services to become the norm and stand up to this kind of crap.
This is addressed in the comments:
> It should also be noted that this project is an example of a solution that is considered to meet certain requirements of the DSA, regarding the protection of minors. It does not prevent the use of other solutions that also meet those requirements.
So I think a better title might be "EU age verification example app not planning desktop support"
(don't get me wrong, I'm not a fan of how this is implemented, but it's important to be accurate in our critique)
A phone should not be a requirement to partake in society, and I´d even argue the same for a bank account. But I see this month another strong push towards a digital Euro. Is that the true purpose behind this push for .eu ID Apps?
I believe it's still possible to use the physical card with a reader for many things.
I think some services still don't work with the CMD. Recently, I had to ask for changes to my car's document, and it seems it's only possible with the card itself. (https://www.automovelonline.mj.pt/AutoOnlineProd/)
Video Demo: https://www.youtube.com/watch?v=MmcUJ5u65Q0
Actual Demo: https://app.hornpub.click
How it works:
1) Go to app.horpub.click
2) Create an ephemeral passkey
3) Extract its public-key and id (this binds the credential you're creating to your device)
4) The user copies this data to their bank's Age-Verification-Section
5) The bank creates an object that it signs with an attestation of the user's age (KYC) and their pass-key-public-key
6) The user copies this back to app.hornpub.click
7) The passkey is verified on the server, the bank's signature is verified by the server, some other meta-data is verified to make sure nothing weird is happening.
8) The user's age has been verified by their bank without the bank knowing who is asking for verification
* This method is more private than anything requiring sharing your photo-id online
* This method doesn't trigger GLBA or GDPR (user copies data themselves)
* This method is free to the merchant (hornpub)
"Hey third fifth of Oregon! Do you want to triple your customer base in Oregon for the cost of a small dev team and 1 month of work?!"
> f*cking app on my phone
I need another app on my phone like I need another hole in my head...
If you're not familiar this would mean the verifier doesn't learns anything except a statement about attributes (age, license, etc); and the EU doesn't learn what attributes have been tried to verify or by who.
What would need to happen in the United States to implement a reliable ZKP age verification system - and how long would it take to roll it out?
Asking because it feels like the Titanic has sunk, and we're eschewing a floating door because the coast guard has regulation conformant life rafts that would work better.
The ZKP approach aims to prevent this attack method.
mPulse
Google Marketing Platform Meta
LinkedIn Ads
Trade Desk
Aggregate Knowledge (Trans Union)
Adobe Audience Manger
Can you elaborate on how the risk of ironbank and hornpub colluding by de-anonymizing you via rainbow tables or IP forensics is substantially greater than Chase and PornHub using - Google Marketing?
This is called "linkability" and ideally should be avoided so anonymous age verification can be safe.
The project is just an example.
It does not mean there will not be support for other ways of verification.
I said what I said, do not @ me.
This is not an accident. This is intent. Look at the arrests for social media posts in the UK and Germany.
This project is not THE digital wallet, it is an early prototype of the wallet (which can be criticized for what it is, but the issue is somewhat orthogonal).
The actual infrastructure is not based on attenstation, if you read the guidelines (or the readme) they actually want to implement a double-blind approach with ZKPs, which imo is significantly better than a challenge-response pub key system in term of privacy as some suggested. And allows for cross-platform (and in theory hardware) support.
If you're not familiar this would mean the verifier doesn't learns anything except a statement about attributes (age, license, etc); and the EU doesn't learn what attributes have been tried to verify or by who.
...what?
> It should also be noted that this project is an example of a solution that is considered to meet certain requirements of the DSA, regarding the protection of minors. It does not prevent the use of other solutions that also meet those requirements.
Is anyone building that service?
This is the equivalent of a "Do you guys not have phones??"[1] but on a way larger scale.
At least where i live i am able to use the bare minimum of phones, even working with tech. The friction is increasing though, which worries me a lot, and day after day there is a new attempt to shove it down your throat if you want to be considered a member of society. Seeing that a lot of countries (including mine) are pushing for age verification, and the whole thing about Android blocking 'sideload', by the end of 2026 you won't be considered a human being without a government certified smartphone.
My brother hates tech more than me, and only has an old flip phone. I'm always surprised by the random problems he runs into as a result. Unresponsive desktop sites that beg you to download apps are the worst.
Mobile phones are the only platform at the moment that can reasonably be used to enforce mandatory software installs and remote attestation. Removing sideloading can down the road leading to Google (or Apple for IOS) forcing all app store provided apps/browsers to support government authentication APIs like this.
emigre•3h ago
nicce•3h ago
throw834920•3h ago
See: https://news.ycombinator.com/item?id=44704645