• 1 Post
  • 110 Comments
Joined 2 months ago
cake
Cake day: November 5th, 2025

help-circle







  • It may theoretically be a false assumption but in practice it’s really not. The MitID identification and signing framework of Denmark, and many other similar systems across the EU, is based entirely on “the device is personal, access to it is limited and the secure enclaves within them are trustworthy”.

    You are correct that this framework is not designed for anyone who wishes to root their device or install a custom OS. In other words, it cuts out 0.00000000001% of the population. The colour of the app has a bigger impact than “oh no! We can’t support rooted devices”.


  • The article is talking about banning social media under a particular age. This is enabled by the new Digital Service Act, and specifically the Age Verification Blueprint within the European Digital Identity Wallet. The same discussion is happening all across the EU exactly because the EU now has shared standards defined for how age verification will work online.

    So while it’s true that counties can enact their own laws, like a US state can, they do so within a framework of European supranational regulation and they definitely cannot (easily) make national laws that circumvent EU directives. Well, they can, but the punishments and the hassle is severe.

    But very specifically these discussions are popping up all over the EU because suddenly the EU is actually putting in place the machinery that allows it to happen. So yes, it’s a French discussion, but one borne of and fed by the European-wide framework discussion.


  • There’s nothing in the EU age verification structure that requires you to hand more information to the places where you need to verify your age. In fact the system expressly prevents it. Similarly in the ZKP architecture, it it not legal, nor possible, for the age verification service to know where you log in.

    Maybe I’ve misunderstood your comment and so I say this in great respect; but if you don’t understand the technical details about the system the EU has defined, you may be basing your resistance on wrong assumptions.





  • I agree that for the system to be anonymous the state has to live up to its commitment to anonymity. Have you read the EU’s regulation about this? In there is exactly a commitment that age verification has to be anonymous.

    But, let’s take a reality check here:

    • For the vast majority of the population, their ISP already collects every single website they visit.
    • if the state wants to know what you’ve searched for and where you’ve been online, they already have that data stored. They can only access it legally with a court order.

    Yes you can circumvent this logging (to some extent) through VPN - just like you can circumvent the requirement to verify your age with a VPN. But the vast majority don’t.




  • What are YOU talking about?

    I’m talking about French age verification, which is a national example of the EU’s ZKP age verification system, and which the article is about.

    To the instance that issues the ZKP tokens you of course have to prove who you are. Once you have the ZKP age verification tokens and actually use them to prove your age, those tokens are negotiated solely between your device and the asking entity.

    Have you actually read the EU’s required structure for this?





  • I’m not an anarchist nor an anti-capitalist but I really appreciate the civil discussion.

    I am 1000% aligned that no government nor corporation should have a dossier with your information.

    That’s why I’m actually able to support age verification online in the EU, because the proposed system prevents exactly that. Your device will literally be issued with ZKP tokens, which solely verifies “the person handing you this token is above 18”. It is a specific requirement that no knowledge can be inferred about who is passing the token (hence the name “Zero Knowledge Proof”). This is a mathematical possibility we can utilise and which the proposal relies on. The Danish trailblazer system is built exactly to this spec.

    I do understand the concern about implementation burden for smaller players (like federated services). In every other case where the burden has been large, open source has sprung to the rescue (eg Let’s Encrypt); I am convicted the same will happen here.