EU published demo video exactly how age verification system works (as well as code, as well as documentation of everything): https://youtube.com/watch?v=ULFTrTznG7Y
They claim “The data privacy of the user is fully respected. The citizens can be sure that there is no tracability of their activities, no user profile can be generated”
They also say anyone (like member states) can deploy this solution, and they can customize to their needs depending on national law and use-cases
I am guessing this EU system will be used for human verification as suggested here:
I am also guessing PrivacyGuides may need a robust system to ensure users are human as well.
So I may suggest instead of opposing this system, consider for privacy guides to fully embrace it, and ensure “devil in the details” are flushed out (which is partially technological, and another more complicated part is improving quality of democracy)
Its not the newest article, but from well informed experts:
As it is today, EUDI has lost my trust, and it does not deserve yours either.
can cause huge damage to persecuted minorities and targeted subjects: it delegates the revocation issuance to a single entity instead of requiring more approvals by a quorum of stakeholders.
In other words, as it is now, a single party can interdict a person to access all these services. This is not good, and it does not have to be this way (technically speaking): we have shown that it can be done in a more resilient way, requiring agreement on the matter by multiple parties
EUDI will endanger the privacy of citizens using it because of the choice of weak cryptography algorithms that may leak information in certain situations
There are of course solutions to the privacy issue, but they aren’t simple
The security model of the EUDI wallet component relies on the Trusted Execution Environment (TEE) layer provided by mobile OS manufacturers: it gives up the use of advanced cryptography to be compatible with an API controlled by an oligopoly of foreign companies.
As if this would not be enough of a disaster, most EUDI “experts” involved seem to ignore the fact that mobile TEEs are not secure at all!
The EUDI specifications are not concerned at all about Quantum Safety and makes no recommendation to face Quantum threats. This negligence makes EUDI already obsolete today.
The EUDI development process seems to disregard feed back from experts, including cryptographers and security researchers, including the feedback I’ve mentioned in this document. Even worst, it doesn’t even care to involve anyone out of the engineering field or business sector of companies profiting of identity services, so this implementation has never been informed by researchers from humanities and social sciences.
It is running biased advertisements across social networks, and running presentations at roadshows, without any critical notion of the impact and role of such a technology in society.
The marketing of EUDI’s implementation is far from these principles and makes Europe’s voice closer to blatant propaganda techniques used by our enemies to enslave their population under totalitarian regimes.
All problems I have listed here have solutions, but they may take time to solve, time that may not fit the plans of bureaucrats busy with matching overdue deadlines and incapable of comprehending the techno-political implications of this rush.
And this is newest article (from month ago), which seems to confirm previous statements:
Much of the research necessary to firmly establish DGCNECT’s pilot in relation to human values is lacking. In this case, it is more than justifiable to adopt a decentralised approach that empowers parents, teachers and IT admins in the field, rather than relying on centralised governance and ID issuers.
I think Europe deserves something better than this; yet, it seems all doors are closed to contribution, and the only way to get involved is to rush the development of a flawed plan.
