Technical issues with Age Attestation that make it a bad idea

The proposal does not provide security for users, but security against users.

Security for users would put me in control of the attestation data¹ and enable me to revoke it if something goes wrong. But revokation was pushed to for later, and instead they rely on “secure storage (SD)”. Secure against me. This reverses the relationship with computers: you’re not the owner, because to make this Scheme work, your device must deny you actions if a remote entity does not grant permission.

So it’s basically a DRM system,² but not to prevent copying of copyrighted media owned by others but to prevent copying of data about the users themselves.

To prevent you from copying data about you.

This impression is strengthened by having to get new attestations every three months. That means that attestation providers can update identifying data about my device at least every three months.

And the attestations are meant to be single-use. On the surface this is a good thing. For example it can be used for money. To guarantee this, someone checking them must ask back at a server whether this attestation has already been used. Zero Knowledge Proofs can be used to reduce the damage to privacy, but like revocation they have been reduced to ”should” not “shall” which means that they are not implemented.

And to enroll to the service, you must prove that you are you, which for most people means video and/or audio identification. The data required for it is absolutely sensitive and heaven for identity theft. And only a Commission curated list of providers is to be allowed, so it’s a known list of data silos.

Most such data silos in existence have been hacked, so it is likely that this data will become public knowledge among criminals after a while.

Also worrying: they say in the document that they want to expand the system to provide “discounts” based on age, also for kids, so this is a children identification system.

Forced identification to a system built to give security against users.

¹ to reduce the risk of theft, the system could maybe watermark the data, so if it gets exfiltrated it can be found out that it was mine, similar to PDFs which contain my name, but not every line of text has it. But not in a way that changes the data I send out for the attestation, otherwise it would identify me instead of attestating something, which would be a privacy risk.

² An aside for that: every DRM system to date has been cracked. Though Microsoft has been working for about three decades to “plug the analog hole” with TCPA and Palladium and followups. Means: have actual full control over users of the system. North Korea implemented that in Red Star OS.

• a relative recently forgot her smartphone in the train. If age attestation required this, they’d now be locked out of services, and it would be unclear how long it would take her to regain access (getting a new phone set up can take days, and backups are unreliable). If the proposal had been realized already, the phone would incentivize criminals to acquire stolen phones to exfiltrate the attestation tokens (which are valid for three months).
• I personally don’t have an up to date smartphone: the one I have is so old that I don’t permit it to go online (I only use it for the authenticator app). The text claims to support desktop usecases, too, but in fact it strictly requires mobile phones, so I would be locked out of anything that requires age attestation. Imagine the impact on homeless people who could no longer just log in via an internet cafe, a shelter for the homeless, or the device of a friend (or rather: the latter would be illegal).
• In a fully free operating system, hiding data from users is not possible, because users can always change the system to give them the data. This scheme therefore strictly relies on locking out users from parts of their own devices, which puts it in the context of trying to destroy general purpose computing. The context: https://media.ccc.de/v/28c3-4848-en-the_coming_war_on_general_computation (2012 – this has been a long time in the making)

Heise wrote about EUDI-Wallet.

The short of it:

• experts expect it to be insecure, privacy violating, and late
• good requirements are removed step by step
• intransparent processes
• risk of identity theft
• providers write the rules themselves
• could provide technical benefits but the current plan doesn’t
• risk of getting something akin to cookie banners but for highly sensitive data
• unclear responsibility in case of identity theft

In the ageverification spec there are similar problems:

In the text I checked there are several instances that say “proprietary (protocol/…)”. Those are telltale signs of intransparent processes favoring a specific company.

Several important parts are marked “should”, which means “won’t because it’s expensive and takes too long”.

The enforced haste is a problem in both projects.

As preface: from the text I’d say that the document was designed by people who know their craft, but they didn’t get to decide on priorities.

That’s why instead of a way for citizens to provide attestations autonomously (it could be that), it became a tool for control over people by attestation providers and attestation consumers.

In Tech the details matter, and the w3 defintion of user agents is a central method to judge the effect of those details: https://www.w3.org/TR/web-user-agents/

A user agent, in general, is any software entity that interacts with other entities on behalf of its user.

With focus to “on behalf of its user”.

Neither the attestation provider nor the attestation consumer are the users of the age attestation app, but the document is written in a way that makes it act on behalf of the attestation provider¹ and the attestation consumer².

¹ ensure that the user cannot make illicit use of the attestations; the effect of the rules are not “must not”, but cannot. This makes a world of a difference, because it removes agency from people. There may be good reasons to break that requirement, but if people cannot, they can no longer take that decision. As an example: there may be good reasons to park your car illegally, but if you cannot, a person in the back may bleed out while you search for a free parking lot around the hospital. You then can’t decide to take that parking ticket to save a life.

² users must provide proof or be locked out, the agency is always with the attestation consumer, not with the user, because the attestation consumer can gate their service with arbitrary requirements; this is even written in the docs: they want to enable companies to use this to provide discounts to minors.

(This preface became much longer than I intended)

About the specific wording in the text:

Not good.

They proved again that Cory Doctorow was already right in 2011:

• The coming war on general computation (video recording from 28c3, 2011)
• “so must a regulation that has broad general appeal but is desastrous in its implementation beget a new regulation aimed at shoring up the failure of the old one.” – Cory Doctorow, 2011-12-27

A small intermission about the problems in German:

Mit diesen Regeln wären die E-Mail-Listen, die mit 15 Teil daran hatten, meine Psyche zu retten, verboten.

Und Microsoft’ler arrbeiten schon seit 2000 mit TCPA / Palladium dran.

Sie nennen es „closing the analog hole“.

Es bedeutet, dass all deine Geräte nur noch erlaubte und einzeln geprüfte Programme ausführen dürfen und jedes Handy sich weigern muss, den Bildschirm eines anderen abzufotographieren. DRM für alles.

Konsequenz:

Kein öffentlich sichtbarer Account mehr ohne Identifikation. Kein Zugriff auf für gesellschaftliche Teilhabe nötige Dienste, wenn der Authentisierungsdienst für dich nicht funktioniert. Das ist viel weitreichender, als aus gmail und Office365 ausgeschlossen zu sein.

Außer für Kriminelle: die nutzen die Identifikationspflicht, um leichter Identitätsdiebstahl betreiben zu können.

Statt dass für Webseiten die bestehende Pflicht eingefordert wird, nicht kindgerechte Inhalte zu markieren, so dass Eltern die clientseitig verlässlich sperren können, werden alle Nutzenden gezwungen, ihre Identität nachzuweisen, bevor sie ihre Persönlichkeit frei entfalten, sich öffentlich zu etwas bekennen, ihre Meinung frei äußern oder ihren Beruf ausüben¹ können.

¹ ich benutze hier bewusst die Sprache von Artikel 2, 4, 5 und 12 Grundgesetz.

To repeat myself: not good.