European "age verification" "app" forcing everyone to use Android or iOS

There are dozens of ways to secure these apps' certificates without using proprietary systems.

Does it need to protect those certificates at all? Maybe I'm too naive, but couldn't this simply be implemented by verifying random challenge signed by a national identity provider?

1. User goes to p__n website
2. Website detects user is visiting from Europe
3. Website downloads them a file containing a random string
4. Website tells them to visit verifyage.gov.example
5. User logs via identity provider and uploads the file
6. Challenge is signed and downloaded through the browser
7. User goes back to the p__n website and uploads the file
8. Website verifies the challenge is signed by a trusted entity

Avoids having to protect the signed challenge at all since it's single use, scheme is similar to authenticating with SSH or WebAuthn. I haven't checked the architecture thorough, perhaps does something similar in the end with more bloat in between.

A mandatory Google account is unacceptable in a OSS Project

How can any form of government enforce anything like this against Linux users installing a distro that entirely ignores this on existing unlocked hardware? If global laws requires all computer to be hardware locked to the vendor's OS tomorrow, instantly "pre-ban" machines would gain in resale value and this would keep many of them out of the trash. It would take longer for them all to electromigrate to death than the politicians behind the ban would be in office

In the case of Linux distros I was thinking desktops/laptops not phones. I haven't personally heard of outright legislation to ban unlocked bootloaders in new hardware anywhere. Even if EU Chat Control requires rather than assuming this, that's phones and desktop computers are at this time almost never sold with non-unlockable bootloaders except maybe by Apple. In the case of Apple I've never used their stuff so that's a "don't know" on my part. Here's the kicker: some EU governments are trying to get their office desktops off Windows due to Microsoft being a US monopoly and part of Trump's fascist regime, and all such governments themselves will need unlockable bootloaders. Also server hardware has to be able to run Linux as Linux is the dominant server side OS. Thus there will always be at least one source of hardware that does not enforce political restrictions on the user's OS whether this be chat control, DRM, or anything else.

Without mandatory scrappage, superseded hardware especially from smaller data centers predating such rules would have considerable resale value, especially if this is a black market.

If all new hardware becomes locked I get no choice but to stockpile pre-ban hardware. I refuse to let the verified/censored version of the Internet into my life. Would go all the way offline before using ID if I really had to

A European company called Volla is now pushing for their "Unified Attestation" service to replace Google Play Integrity, but their product still has all the same problems as Google's version does. It still bans rooting your device and restricts what OS you are allowed to run.

The GrapheneOS team went into detail on the various issues here: https://grapheneos.social/@GrapheneOS/116200110686604617

Let's be honest.... Normal people who root their devices won't try to crack or tamper the app or bypass protections. Also.... If you care about the files of the app in /data/data/com.package.name you could just encrypt the most important ones even with a key generated during the first open of the app which will use entropy. What can do root now? Is the problem stuff like http toolkit? Detect it and in case block it or block adb, but even if someone can know what calls the app does, the app is opensource anyway so there is no point in doing it... You see? What is the point of fighting root? Are you scared that someone could replace the ID or values used during verification process? Don't store them but use identifiers and immediately drop them after verification is successful. This way unless the person provides a valid ID immediately they will fail to verify. Play integrity is unnecessary, are you scared of people tampering the apk itself? Add signature verification to the apk, if that's tampered app will fail to start displaying signature doesn't match. Are you scared someone will anyway beat the app internal signature system? Verify it as well by a server check. Again, play integrity being useless.

Did my comment about my 1984 comment getting removed really get removed??

Damn.

Tells me all I need to know.

This is a measure to ban general computers. We will all be made to give up real computers and own a locked phone with telescreen features and censorship.

Remember that EU actions, for better or worse, are imitated all over the world.

If the concern is Russian farms offering automated ID verification for a cost, do note that this "security" can and will be spoofed, with a new method appearing almost a few days after the current one is patched. It will only hurt legitimate users.

WHy not use something like this?
Unified Attestation??
Single backend · Offline verification · No device IDs
Attestation that feels boringly reliable.

Unified Attestation is a free, open-source alternative to Google Play Integrity. It delivers short-lived integrity tokens signed by a single backend, verified offline by app servers, and issued via a privileged Android system service. It can live alongside Play Integrity, and it’s simple to integrate for app developers on both the app and server sides.

An initiative by Volla Systeme GmbH.
Volla Systeme GmbH is a Gemran based Company so European what means that this would make more sense as using a American controlled services that locks people into the Stock roms that can and will harvest data with no option to disable data harvesting, forced cloud account to install applications over the intended way and other anti features the EU doesn't stand for based on the Privacy regulation (i am just assuming and hoping here).