EU Age Verification Project to Require Hardware-Bound Attestation

The European Union continues to build out its infrastructure for verifying users' ages online, and, as the title of the piece indicates, the project in question calls for mandatory use of so-called hardware-bound attestation.

The essence of the approach is that age confirmation rests not only on data entered by the user, but also on a cryptographic binding to a specific device. Such attestation is typically implemented through trusted hardware modules that issue a signed confirmation which cannot be spoofed at the software level.

For users and developers, this raises a familiar set of questions: mechanisms like these have traditionally caused concern in the community, since a rigid binding to “trusted” hardware can restrict freedom of platform choice and complicate the operation of open systems, where full control over the device remains with the user. The discussion of the news on Hacker News (106 points, 60 comments) shows that the topic is met with mixed feelings.

The details of implementation, the timeline and the list of services covered do not follow from the brief description available, so it is premature to judge the practical consequences for now. One thing is clear: the EU's line on mandatory age verification is taking an increasingly technically rigid form, and the question of the balance between protecting minors and the privacy of adult users remains open.

Source: Hacker News