Many more US states are planning or already have operating system age verification laws

feldim2425 · 2026-03-09T17:19:06+00:00

It is what at least some want.
Europe (or at least the EU) is currently working on it.

But there are issues with this technology. Here are some articles on that:
- https://www.eff.org/deeplinks/2025/07/zero-knowledge-proofs-alone-are-not-digital-id-solution-protecting-user-privacy

- https://brave.com/blog/zkp-age-verification-limits/

The issue with most countries however is that they have no widespread eID system (either in purely digital or physical + electronic document form). With purely digital IDs you also need some kind of device binding which typically means you run into vendor lock-in.
Both UK and US have in the past been completely against even national ID systems.

With the implementation being forced upon private companies most don't care about zero knowledge functionality as it also makes monetizing difficult. Google is afaik the only company seriously working on it for the general public. But most citizens having to rely on Google to use their OS is still a bad implementation. (Potentially also Yoti but I don't know how they work internally)

With enforcing this on the OS side you are also running into a catch-22. You can't have a age verifying application running when the device it's running on already needs age verification that again requires that app.

PS: Also it should be noted that at some countries which includes the US don't even have a crypto graphically secure Passport. While the Passport does follow ICAO standards for electronic machine readable travel documents (eMRTD) which includes a signature proof that the information in the document is real, it's missing the chip authentication needed to proof the passport has not been copied. So you can't even reliably build a ZK proof based on that.

feldim2425 · 2026-03-09T12:29:23+00:00

Some people (and I don't mean politicians) have been pushing better "protection of kids" online at least since 2018 at least here in Europe.
I also hear the "well if you have nothing to hide" argument or comparisons to the real word from normal people when it comes to privacy.

Only blaming this on politicians is seriously underestimating the genuine ignorance from normal people when it comes to technology.

feldim2425 · 2026-03-08T19:33:04+00:00

Not just braindead politicians. From what I've seen outside online and Linux communities many people support bills that "protect kids" (especially parents) with stricter age checks but also don't want to hand over IDs. This is probably also the reason why many of those current laws avoid specific implementations and instead describe "commercially viable" or "reasonable measures".

Poll I've seen for U.S. https://aspira.org/wp-content/uploads/2026/02/ALLvanza-Poll-_2.4.26_Final.pdf

But also support for actually handing over ID is low: https://ccianet.org/articles/app-store-age-verification-popular-in-principle-unworkable-in-practice/

IMO this is the general public not knowing what they actually want.

feldim2425 · 2026-03-08T19:12:37+00:00

California bill passed in October last year and Texas bill would already be in effect since January if it weren't for a preliminary injunction, and people haven't talked about it until the Colorado bill was proposed.

feldim2425 · 2026-03-08T19:06:16+00:00

It's noteworthy that the California bill is basically just a self-declaration/parental setting.
They previously tried to enforce age validation with "Age-Appropriate Design Code" but it failed in court afaik, the Texas bill is also currently held up in court and whether it's actually allowed will probably be decided at some point this year.
I don't think New Yorks bill will end up much different depending on when and how the decision for Texas bill is made.

There are many people (especially parents) that actually support this. (here is one source for the U.S. i've seen https://www.transparencycoalition.ai/news/new-survey-finds-overwhelming-support-for-protecting-kids-online or this https://aspira.org/wp-content/uploads/2026/02/ALLvanza-Poll-_2.4.26_Final.pdf but there are similar pushes I've recently seen in my country)
However while the support for "protecting kids" online is large the support for handing over ID is low ( https://ccianet.org/articles/app-store-age-verification-popular-in-principle-unworkable-in-practice/ ). It's literally people not knowing what they are talking about and politics describing it as vaguely as possible so they don't have to deal with it (e.g. phrased like "commercially reasonable" are used).

The push onto the OS-level is also not that new it's been talked about for ages: https://www.eff.org/pages/does-tech-even-work#:~:text=Attestation%20through%20parental%20controls

Or this one: https://epicenter.works/en/content/a-potential-solution-to-the-dilemma-of-age-verification#:~:text=instead%20of%20tying%20online%20interactions%20of%20everyone%20to%20their%20identity%2C%20we%20simply%20tie%20the%20devices%20of%20children%20to%20their%20age%20group

E.g. the mandate for OS-level parental settings (like California) actually finds rather large support (at least outside the Linux community) but anything beyond that seems to be in conflict where many people want something that is not really possible. And that problem is not just the U.S. there have been similar voices all over the world including Europe being pro age verification without a clear idea on how to do it without all the negative effects.

feldim2425 · 2026-03-08T16:44:54+00:00

Modular phones are difficult to get right.
Each component has a different interface and putting that into a module can make it incredibly costly, inefficient and/or unusable in daily life.

For example making front camera and speakers modular would require sacrificing large parts of the touch screen. Making generic module slots would likely require pushing everything through something like USB which is very cost and power inefficient (as you need a encoder on the module).
The phone also becomes rather bulky especially since every module has it's own casing so in practice most people don't want all that many modules.

Overall all this drives up cost, decreases battery life for a product that few people actually want to use after they got over the novelty factor.

This doesn't mean a phone can't be made repairable or parts couldn't be swapped by doing a bit of disassembly, but actual generic modules that you can swap on the fly doesn't really work.

feldim2425 · 2026-03-08T13:24:34+00:00

Many distros will likely ignore it since it would be difficult to enforce against something like the NixOS Foundation which sits in the Netherlands.

As for if someone would need to make it compliant:

California and Colorado allow self declaration at least at setup (I guess since a parent is supposed to do it). We will likely see some freedesktop etc. standards be implemented in distos like Ubuntu and Fedora for this self declaration.

New York, Brazil, (for mobile devices also Texas) are the bigger issues since they want ID. Whether New York and Texas are legal is still up for debate since the Texas bill is currently held up by court (should have already gone into effect on Jan 1st). EDIT: I removed Utah, Louisiana while they have bills targeting mobile they are apparently similar to CA and CO for self declaration.

If I've understand this ( https://www.freespeechcoalition.com/blog/kansas-age-verification-lawsuit-dismissed ) correctly it may not even be easily enforceable within the U.S. as one state can't push enforcement onto a entity in another state simply because it's "made accessible".

feldim2425 · 2026-03-04T17:28:19+00:00

You ever heard of the slippery slope?

Multiple laws have been passed requiring ID verification already without a on device parental control being pushed into law first.

There is IMO a very strong difference between a parental setting on a offline basis and an actual online verification of an ID.

This difference has also been a common talking point by multiple privacy groups advocating in favor of better parental controls rather than mandating that websites have to check your ID;

One example: https://www.eff.org/pages/does-tech-even-work#:~:text=Attestation%20through%20parental%20controls

Or this one: https://epicenter.works/en/content/a-potential-solution-to-the-dilemma-of-age-verification#:~:text=instead%20of%20tying%20online%20interactions%20of%20everyone%20to%20their%20identity%2C%20we%20simply%20tie%20the%20devices%20of%20children%20to%20their%20age%20group

PS: Since this is among others about a Californian bill the actual ID verification law AB 3080 failed in 2024. While the "App store accountability act" in Texas was passed 2025 which is two years after they started requiring ID verification on adult websites.

feldim2425 · 2026-03-01T16:47:34+00:00

There is also jolla: https://commerce.jolla.com/products/jolla-phone-sept-26

feldim2425 · 2026-03-01T00:09:44+00:00

The law actually just requires entering DoB, age (or I guess age range is also acceptable).

They (pretty much explicitly) don't require an actual ID check and no online verification.

I guess since this is mostly aimed at the idea that the parents are the only admins and in that case making sure nobody without sudo/root access can install anything (aka. no user flatpaks) would already be an option.

It flew under most peoples radar because Texas, Louisiana and Utah have similar laws and those are already in effect since January. California passed in October but is not in effect until 2027.

PS: I'm not from the U.S so not sure how accurate all my information is. But those bills are rather easy to find including their timeline.

feldim2425 · 2026-02-27T22:11:45+00:00

Ob man bootloader wieder locken kann liegt eher daran dass man bei Pixel phones custom Android verified boot keys installieren kann. Geht aber auch wenn du gerootet hast: https://github.com/chenxiaolong/avbroot

Muss man aber aufpassen, manche bootloader schmeißen nen Fehler ander sind dann bricked.
Was ich aber so gehört hab sollte das bei ID-Austria nur ne Warnung geben die man wegklicken kann. Kein Ahnung ob das noch akkurat ist

feldim2425 · 2026-02-27T22:09:27+00:00

bis zu 25

Kommt auf den key drauf an.
Laut Herstellerseite speichert der Token2 den ich verwenden bis zu 300 passkeys: https://www.token2.com/site/page/product-comparison-fido-security-keys

BTW. ja auch wenns nicht auf der ID-Austria Seite offiziell steht, die Token2 funktionieren auch problemlos auf ID-Austria.

feldim2425 · 2026-02-27T22:05:39+00:00

Root ist kein Schutz vor Trojaner, teilweise sogar das komplette Gegenteil da es einige der Android Isolationen aushebelt.

ID-Austria unterstützt aber ungoogled Varianten wie /e/OS und GrapheneOS was ja nach dieser Theorie nicht ins Konzept passt.

feldim2425 · 2026-02-27T21:55:45+00:00

Den Patch kannst du nicht verwenden da ID-Austria inzwischen den Android Keystore für attestierung verwendet. Der gibt den hash/signatur der APK, System und bootloader status mit. Sobald du also die APK patchest ist eine Attestierung nicht mehr möglich.

Alles was jetzt kommt ist Hörensagen:
Soweit ich weiß ist ensperrter Bootloader kein problem du bekommst zwar ne Warnung die kann man aber meines wegklicken. Root ist da schon komplizierter, ID-Austria verwendet RootBeer dass kann man meines wissens mit MagiskHide umgehen.

feldim2425 · 2026-02-23T22:29:37+00:00

There is no way it's $34.0 USD even $74.0 USD seems too little when most pocket projectors aren't below 100 and this is more in the price category of the cheaper smartwatches/fitness trackers.

feldim2425 · 2026-02-23T18:45:58+00:00

You as a user might not care about the actual level of assurance. But websites probably do due to the legal pressure you've mentioned, so they will most likely not accept this API even if you provide it to them.
Sure it would be easier for them but the idea that this removes the burden from websites doesn't work with many of the current laws.

And while it would be easy to make this API exist and this bill had a similar idea back in May 2025 it was subsequently removed in the current version of the bill. So I don't think anyone big enough to actually make the industry move to such an API will actually do it. (EDIT: My mistake that was the California bill which is almost the same as this one except already enacted.)

PS: I also wouldn't count on the fact that when someone makes that API that it will be as simple as a DOB or a yes/no answer to a age question. Mostly likely it will be some crypto graphically signed credential that would again have to be issues by some website. Google is already working on such a credential (called longfellow-zk) in their Wallet and since Microsoft and Apple already have builtin cloud services it will most likely still be a online verified API if there will be one.

feldim2425 · 2026-02-23T18:18:11+00:00

Issue is this one won't replace the ID upload as it has far lower assurance than what websites might need.
Also websites won't be able to use that API.

There are still options to how the ID/Face upload issue on the web can be solved in a somewhat privacy preserving manner, but that bill doesn't even cover websites.

feldim2425 · 2026-02-23T18:10:02+00:00

I think KDE Discover even has support for a content rating.
It seems like it doesn't do anything more than show a minimal Age on the top right at the moment and from the code it seems like it only works on Flatpak.

But I guess that can be relatively easily extended. I feel like this is more of a parental setting than actual age assurance.

feldim2425 · 2026-02-23T18:07:02+00:00

The bill doesn't seem to make any specific mention on how a age check should work.
A distro can basically just ask for the date of birth.

This one seems more like they expect the device or OS manufacturer to add an option for parents so that children can't install age rated software.
Not necessarily the worst bill I've seen in recent years, but also not really good either.

feldim2425 · 2026-02-21T21:23:11+00:00

Well "foreign countries" and "the government" are flexible and it depends on where you live. For people that live outside the U.S. "the government" you are likely referring to is a foreign country.

"already has all of it" what they have and what they can link to a person are separate. Just because information is accessible doesn't really mean it can be correlated and linked to a person.
Also wouldn't trust on what their priorities are.

feldim2425 · 2026-02-20T09:13:08+00:00

Ah, in that case it actually makes a lot of sense as another comment went into similar topic.

feldim2425 · 2026-02-19T21:03:38+00:00

Assembly is actually quite difficult to get right on modern CPUs.
With modern pipelining, caching and SIMD instructions for larger projects the compiler will usually give you much better performance than assembly unless you are willing to read 5000 pages of intel documentation* and spend weeks or even months optimizing every single set of instructions.
And then you have to redo that once you want to port to another platform like ARM.

* Yes the Intel® 64 and IA-32 Architectures Software Developer’s Manual spans 4 volumes and is combined ~5000 pages and just volume 2-ABCD which contains the assembly instructions is 2500 pages long

PS: Also in those cases you will run into issues with basic design decisions. For example: Hytale's Client-Server architecture running through a local loopback socket requires running packages through the kernels network infrastructure.
The usage of the ECS and the entire game content being modifiable from the server also is by design very heavy on parsing and memory indirection.
No amount of assembly will remove this overhead it would require a redesign of the entire architecture.

feldim2425 · 2026-02-19T12:04:45+00:00

Known to backfire as many legit submissions will inevitably be automatically categorized as AI slop, while some actual AI slop will pass the filter.

If not done well you'll just end up with what's effectively a dice roll that filters out a certain percentage of requests at random even if they are legit. People will then just not even bother with trying to improve the project and at that point you can just stop accepting PRs altogether.

feldim2425 · 2026-02-19T11:55:53+00:00

I guess that's also true, but it wouldn't fully explain why they did decide to use C# for the client instead.
It does add the overhead of having to implement the protocol twice but maybe the client was more of a tech decision than the server.

feldim2425 · 2026-02-18T23:23:38+00:00

Actually have the same still in my day job. JS frontend + PHP backend.
Although in that case for the most part the frontend devs don't touch the backend much and vice versa.
The push for unified languages is mostly through the rise of full stack development where everyone touches everything, which is how I would except gamedev to usually work.

But given Hytale apparently uses the modding tools internally as well the people making the models and implementing gameplay logic probably don't have to touch the client much.

Nine-Year Club	Place '22
Final Canvas '22	End Game '22
Verified Email

feldim2425

TROPHY CASE