The EU wallet seems to expect the user to simply have an Android phone with Google Play services that passes Google Hardware Attestation, or alternatively an iOS phone, or apparently you’re not a citizen: https://leminal.space/post/31858818/21120139

I don’t think you’re making a relevant point, but I’m not interested in continuing. Sorry for the terseness, I just don’t want to drag this on.

I provide whatever I think is useful for the discussion.

I heard Codeberg already struggles with spammers, so I get that. But letting big surveillence data companies like the credit card companies solve this, seems like one of the worst ideas. I’ve seen e.g. discourse use a gradual trust system, there likely are other ways.

I wasn’t arguing against Passkeys, just pointing out how they are often perceived.

I was definitely arguing against TPMs, however. https://gist.github.com/osy/45e612345376a65c56d0678834535166 https://pluralistic.net/2024/01/18/descartes-delenda-est/#self-destruct-sequence-initiated https://www.elevenforum.com/t/tpm-2-0-is-a-must-they-said-it-will-improve-windows-security-they-said.13222/ https://scispace.com/pdf/tpm-2-0-uefi-and-their-impact-on-security-and-users-freedom-2e1ldhodqq.pdf https://www.gnu.org/philosophy/can-you-trust.en.html (But Passkeys apparently don’t need them, see my KeepassXC mention before.)

Passkeys seem to be advertised in ways that puts people off (edit: not saying that makes them bad):

• TPMs, Secure Enclaves, etc. are deeply closed-source and security by obscurity. Until there is an open TPM implementation available, many users may prefer not to rely on them. It seems like KeepassXC allows circumventing TPM for Passkeys, but most people probably don’t know that.

• Too much “trust me bro, my cloud is safe” advertising from big Passkey advocates like Google to try to get people to use their invasive services.

• A classic hardware key may be indistinguishable from a normal password being entered. But Google has announced they want to push passkeys against user’s wishes here: “Is opting-into passkey mandatory? No, […]. However, over time, as users become more accustomed to passkeys, we might limit where we allow passwords to be used because they’re less secure than passkeys.” Again, not a great look.

• Collecting biometric data is always dangerous, too many attack vectors during processing. I’m aware that Passkeys can be used without that, but many people may be put off by that push.

I think that’s why Passkeys have poor adoption among privacy advocates, even though most problems seem fixable.

Caring about privacy and caring about the details of a security protocol are distinct. You’d be surprised how many people who care about privacy are deeply wary of passkeys because of the biometric factor, which is unfortunat

Gitlab.com has similar problems, sadly. Meanwhile, I haven’t ever heard of Codeberg doing somethign similar, but who knows I guess.

Gitlab has a horrible UI when you have a smaller screen or lower end device, and I heard also not really great server-side performance compared to forgejo and gitea.

Also, the gitlab.com instance randomly blocks people or demands their credit card data.

It is shocking that this (apparently???) doesn’t seem to be illegal.

I have no Android phones. Just avoid the privacy disaster apps entirely. Switch your banks, buy transport tickets that are printed out. It’s a nuisance but it’s possible.

Available options for mostly open systems among others seem to be the PinePhone, the ClockworkPi uConsole, and the Librem 5. The latter two seem to have significant shipping delays and more technical caveats, however.

While on some level I agree, perhaps it’s time to push Linux phones as well?

For anybody who has any sort of techie knowledge, that could be a better long term option once Linux phones get more momentum and funding.

The EU has apparently decided that this has to be done for most public platforms by July 2026, so Discord may not have much of a choice and other platforms will likely follow: (Edit: I forgot, the EU strict age verification stuff seems to be limited to EU DSA’s definition of “platforms” so as a text messenger I’m not sure Discord is part of it. But this’ll still likely be coming to more services near you and perhaps Discord is just voluntarily joining the chaos…)

I could be wrong I’m not a lawyer, assume everything I write from here is bullshit, but see here:

https://www.mlex.com/mlex/articles/2368265/online-services-get-up-to-12-months-to-apply-age-verification-eu-guidelines-say “Online services get up to 12 months to apply age verification, EU guidelines say” This was in July 2025.

EU guidelines in question seem to be:

1. https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-protection-minors and

2. https://ec.europa.eu/newsroom/dae/redirection/document/118226

Quotes:

“[…] the Union legislature enacted Article 28 of Regulation (EU) 2022/2065 of the European Parliament and the Council (6). Paragraph 1 of this provision obliges providers of online platforms […] to ensure a high level of privacy, safety, and security of minors, […]”

“Self-declaration is not considered to be an appropriate age-assurance measure as further explained below.”

“In the following circumstances, […] the Commission considers the use of access restrictions supported by age verification methods an appropriate and proportionate measure to ensure a high level of privacy, safety, and security of minors: […] an online platform accessible to minors has identified risks to minors’ privacy, safety, or security, including content, conduct and consumer risks as well as contact risks (e.g., arising from features such as live chat, image/video sharing, anonymous messaging)”

“Age estimation methods can complement age verification technologies and can be used in addition to the former,” (AKA the alternative to a literal gov ID check seems to be big data AI sucking up all user data to estimate user age.)

The in my opinion horrible solution the EU seems to have found to avoid sharing the physical ID for services that don’t want to request one, is apparently this app: https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui Which from what I can tell

1. The EU app seems to require Google device attestation so all custom ROMs are out and to be a citizen you can apparently no longer own your device,

2. Unless you use iOS or Android you’re apparently not a citizen,

3. Once everyone is used to using some citizen app like that, I feel like a fascist government could easily tie it to a social score or other authoritarian measures bewyond the age verification.

4. There is a privacy friendly alternative approach anyway, that most governments seem to conveniently be ignoring:

https://www.politico.com/news/2025/10/13/california-law-online-age-checks-00606115 (I think Germany may already ask something like this of the more popular preinstalled operating systems, but I could be wrong.)

Anyway, I’m not a lawyer and this isn’t legal advice. But spread the word, somehow press seems to be ignoring this.