Not true. The device's public key is also sent, which functions as a stable device identifier.

We've spent years trying to get away from stable tracking IDs and fingerprinting. Returning to a system where devices are sending a stable ID to a website to prove ownership is a step backward.

There are proposed mitigations like issuing multiple sets of credentials or rotating them, but we're not going to get an infinite number of keypairs for every website or session in the secure enclave in practice.

Another reason why these proposals aren't getting much uptake is that they aren't addressing what the lawmakers are pursuing: They don't want anonymous authorization tied to the device. They want IDs tied to accounts and a way to discourage people from sharing IDs. In the anonymous systems it only takes one person a few minutes to put an over-18 identity into a device and there's no way to determine if someone is abusing the system by stealing IDs or if someone's 18 year old brother is setting up all of their younger brothers' phones for $5 each.

The situation gets stickier when you acknowledge that it's not possible to limit all of these websites to only mobile phone devices with secure enclaves that are not jailbroken. Once you open a door to desktop devices and other OSes accessing these sites, you open the door to replaying and proxying attacks, where someone will produce those `over_18` attestations on-demand for you, possibly for a minimal price. This brings us back to the public stable identifier to discourage fraud, which means governments won't be happy to issue as many keypairs as we want, which means we're back to semi-stable fingerprints.

This is covered by allowing for single-use credentials. IIRC the EU personal IDs will use this. Basically, the wallet requests a batch of single-use eIDs that all use different device key-pairs. Each credential is only used for one request and then deleted. The wallet will automatically request new credentials in batches when they run out. The old key-pairs are deleted along with the credential so you don’t run out of space in the secure enclave.

> Another reason why these proposals aren't getting much uptake

I’m not sure what you mean by not much uptake, EU countries are required to issue and accept them for official business by the end of 2026

They said There are proposed mitigations like issuing multiple sets of credentials or rotating them, but we're not going to get an infinite number of keypairs for every website or session in the secure enclave in practice.

> Basically, the wallet requests a batch of single-use eIDs that all use different device key-pairs.

The comments you replied to omitted mass surveillance. But the article and 1st comment included it. The government would know what wallet requested each single use identifier.

Which only means that the government knows how many tokens each citizen consumes on average. They don't know where each identifier was used nor the exact timestamp unless each website communicates this to the government, and such a backchannel does not exist in the spec.

And governments investigated high electricity users as suspected marijuana growers. Would governments ignore high identifier use?

But this then means that the issuers and the verifiers can trivially collude to deanonymize holders/users.

It doesn't prevent tokens from being stolen or sold, but the token issuer only accepts each token once and can limit the rate that tokens are issued and control how fast they expire, giving decent control over how practical using stolen or sold tokens are.

There is verification. And then there is continuous control. The later is even more problematic.

Personally - this is less acceptable to me than just having the site collect my image/id.

I'd support just putting the id in a dedicated device (ex - gov issues smart key) or just accepting that sometimes people will share id info (just like... physical ids).

It doesn't even close all the doors to transferring ids - since I can still just hand someone a phone (just like... physical ids).

https://www.smithsonianmag.com/smart-news/doppelgangers-dont...

Ex - People change hair color, lose a boat load of weight, wear eye-color changing contacts, drastically change hair styles (facial and normal) etc...

No one bats an eye at an ID that "only sorta vaguely resembles you" outside of a very limited subset of places (the only one I can actually think of is Customs while traveling).

---

So my take is that as long as the gender appears similar and the ethnicity seems "close enough"... the store is still going to sell you alcohol, the bar is going to let you in, and the movie theater is going to sell you tickets.

I have to mention that EUID is not private, since there's "provider" element which informs website if you are 18 or not. The flow is:

1) You scan QR code 2) Your EUDI wallet does verification, informs provider to tell you are 18+ 3) Provider informs website you are 18+

The EUID draft doesnt mention tech like ohttp for anonymizing requests. So there's risk of provider keeping track of who you are. So while everybody claims its fully anonymous which is just false. Government could ask website/service for the token or account information then use timestamp or token then combining with "provider" logs, your identity will be exposed.

EUID has another problem which is letting all countries implement system, which is wasteful duplication effort so this probably will be outsourced and to same company to reduce duplication efforts. Then it'll be centralized and they happen be collecting telemetry data for "experience improvements" as everysite out there do.

I haven't even mentioned biggest problems like requiring attestation Apple/Google. While spec doesn't require it, but the likehood country's app requiring it will be very high.

It will probably be a small country, one that is known to give no fucks about big tech.

Yeah, and no Linux PCs, no custom builds of web browsers (which would effectively become open source in theory only)—basically the end of any kind of open platform. I would much rather just scan my ID!

IMO, there are two other issues that need to be solved. The major one is that there should be some way to do attestation of devices that are not Google-certified Android or iOS. If this does not happen, the smartphone duopoly is permanently entrenched and not a fair/free market anymore. There is no way to use a smartphone without basically losing your privacy to Google/Apple and given the increasing importance of online services it's becoming increasingly impossible to live without a smartphone.

It was very disheartening that the EU reference implementation was rolled out with only Play Integrity and Apple's counterpart. IMO, this should have been solved before the reference implementation was rolled out to member countries, because many of them won't bother to go beyond that [1]. It is also completely counterproductive when it comes to EU tech sovereignty. There is a group of pioneers that are growing the sovereign ecosystems and then you cut them off.

The second, perhaps lesser, problem is that the security story is not super strong, because most Android phones do not even have a secure enclave (outside Pixel and Samsung flagships/A5x, there are very few). Instead they rely on TrustZone etc. which are regularly targeted by side-channel attacks, etc. Ironically, GrapheneOS is cut off from most of these systems (because Google Play Integrity), while it actually requires a secure enclave and is more secure than... well I guess every other smartphone.

[1] There is some hope, e.g. the developers of the Dutch identity wallet acknowledge the issue and are open to supporting alternative systems.

IMO, just don't do the proof of possession. If I have the token that says I am an adult, I can use it to be considered an adult online. If someone requests millions of tokens and sells them, then punish that someone. It's not very hard to find them: they have to sell those tokens somewhere.

Also don't try to solve the VPN issue: I highly doubt most kids will use VPNs to access social media, and accessing porn isn't that hard if you are capable of running a VPN.

Again, I can consider age verification as some kind of "inconvenience for under age people". But the age verification that works 100% of the time is a problem, as you say it will lock people out with remote attestation and that is not acceptable.

I'll stop you right here. I don't want to be forced to use a government issued ID — one the administration can revoke at a whim, one that will certainly be backdoored by intelligence agencies including the ones they haven't told you yet — just so I can talk to my friends online.

It's insanity that we are asking the state to regulate personal identity — and trust them with it - in 2026 on hacker news.

This is completely unacceptable. In practice, this solution means a locked down device, probably controlled by Google or Apple.

The Internet has existed without identity or age verification for more than 30 years, and there is no reason to change that.

the very first line, government issued digital id - we have been avoiding that for a very long time

how does this work on an open source operating system?

The expression "papers, please", a classic exemplar of dystopian control, is referring to what?

> First, it can be open source and have DRM and attestation. Android is open source, for instance.

When people say "open source" in this context they mean that the user or third parties can make changes to the system, not that the source code is thrown over the wall from time to time. The situation with Android is exactly the thing that we don't want.

Do they? My experience is that often they don't know what "open source" means in the context of software or that they don't know that the system they were criticising is actually open source.

I can read the sources of AOSP, I can modify it, build it and install it on my device.

I can read the sources of AOSP to find bugs or security issues.

I can read the sources of AOSP to understand how it works and get inspiration for my own projects.

What does it compromise to you?

Maybe you're unhappy about the fact that it is not open development, but that's a completely different question and many, many open source projects are like that. I have offered PRs to multiple projects that never bothered reviewing them because they did not care, and that is exactly how open source works.

There are so many reasons to complain about Google, the fact that Android is open source is not one of them.

In the EU, there is no concept of EU ID, each country is responsible for their own.

Still, there is a governing entity that is responsible for your ID and controls it. Unless a US state is not a "governing entity"? Though the head of a US state is called a "governor", right?

Even the REAL ID Act only mandated requirements for a license when used to enter government owned or regulated property, and states can still choose not to abide by it.

you specifically talked about an OS without user changeable software, thats the definition of open source

Wait, so you live in a country where there is no government that can provide an ID? How does it work when you travel abroad? Do you have multiple legal identities, with different names and nationalities, that cannot be individually tracked back to one government?

> you specifically talked about an OS without user changeable software, thats the definition of open source

No? Open source is about your ability to reuse the code. You can modify and install Android (or let's say AOSP) on most Android devices (look at the list of devices supported by LineageOS for instance).

The one thing you cannot do is modify it and get your changes signed by Google.

Remote attestation is about preventing you from leveraging open source software, but the software is still open source.

there is no point in it being open source if i cannot modify and run it

I am not sure what point you are trying to make. The government controls your passport, your driving licence, your national insurance number for taxes, but because those are 3 different IDs, it doesn't count as "your government controls your ID"?

Feels like you're just nitpicking for the sake of it.

> there is no point in it being open source if i cannot modify and run it

Well I for sure hate the idea of remote attestation, I agree with you on that. I was just pointing out that saying "it's not possible to have remote attestation on an open source system" is wrong: it's possible, that's a big part of why "they" like remote attestation: because they have control even if you can tamper with your system.

Illegal offerings won't do either of course. That can only be achieved by whitelisting a kid-net. Resource intensive, but only choice if you want unsupervised kid safety on the net. Because the net isn't kid safe and it cannot be by design. So you would need to create a subnet with actively moderated content.

Any other proposed mechanism has severe flaws. The only other choice is active parenting, which is unrealistic. An internet ID solves nothing, but creates more problems.

(Do you mean something specific like HHS' Active Parenting™? https://preventionservices.acf.hhs.gov/programs/744/show )

Most approachable is the device having some kid mode. In this mode online platforms need to send a respective header to authorise the content as kid friendly.

If that is missing, access isn't possible. In this case parents just need to check that the devices of their kids are configured properly.

Do regular desktop and laptop computers have the same secure enclave feature?

So people in dubious legal circumstances are locked out the internet?

“You must be this tall to ride this ride”

“ you must be 18 to own an iPhone 18+ “

I apologize for the drive-by question, and I appreciate your takes!

This assumes that the government would be able to verify independently a phone serial number so that people’s IDs aren’t leaked. If not, then you’re back to the same thing as before since “drivers licenses” are stored by sites and shared around with advertisers

And there it is.

Technically it is possible. The complaint that people have is that they don't trust that any government will get it right. But it is technically possible with known cryptography.

But if you accept the caveat (like we do for cigarettes, where an adult can buy cigarettes and then give them to a kid), you don't need to remote attestation part.

And if you have to trust the government to get it right then you have already lost because they are definitely motivated to NOT get it right because they WANT to track you.

Of course it is. Read the sentence again:

> The government still gets to know what you're doing online. How is that privacy?

It is technically possible to achieve that without the government knowing what you are doing online.

> With true anonymity you can also re-sell tokens making them meaningless.

You can re-sell tokens, just like you can re-sell cigarettes. Does that make the system meaningless? Harder to prove.

> And if you have to trust the government to get it right

The whole point is that you don't have to trust; you can verify. The system has to be open source of course.

It doesn't mean that they will do it right, but it is technically possible.

And now you're going to tell every state to do it again, but this time it's got a chip in it so "just trust the government, man".

This will go well.

RealID is completely optional anyways. Just like organ donation and using the internet.

You need mobile phone anyway.